← Database

CVE-2022-1589

HIGH CVSS: 7.5 Published: 2022-05-30 Modified: 2026-06-17

Description

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector

Affected Platforms

Wpexperts All In One Login

Weakness Type

CWE-352, CWE-863

References