CVE-2022-2123

WP Opt-in <= 1.4.1 - Arbitrary Settings Update via CSRF

EPSS 0.4%CWE-352

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Jul 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emails.

Affected products

Want to know if your infrastructure is exposed to this?

References