WordPress Plugin Vulnerabilities

Permalink Manager Lite < 2.2.20.2 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
permalink-manager
Fixed in 2.2.20.2

References

CVE
CVE-2022-4021

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
4b1247ea-d2ec-4b69-a79b-4ba377693ddc

Timeline

Publicly Published
2022-11-16 (about 3 years ago)
Added
2022-11-16 (about 3 years ago)
Last Updated
2022-11-16 (about 3 years ago)

Other

Published
Title
Published
2026-04-21
Title
mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function
Published
2014-12-18
Title
Gslideshow <= 0.1 - Multiple CSRF
Published
2024-11-28
Title
Simple Header and Footer <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-01-30
Title
Robo Gallery <= 3.2.11 - Cross-Site Request Forgery
Published
2023-10-18
Title
Google Calendar Events < 3.2.6 - Cross-Site Request Forgery (CSRF)