CVE-2022-1956
Shortcut Macros <= 1.3 - Subscriber+ Arbitrary Settings Update
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
11 Jul 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.
Affected products
Unknown · Shortcut Macros