WordPress Plugin Vulnerabilities

Captcha Code < 2.8 - Settings Update via CSRF

Description

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack

Affects Plugins

Plugin icon
captcha-code-authentication
Fixed in 2.8

References

CVE
CVE-2022-37411

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Rasi Afeef
Verified
Yes
WPVDB ID
ac895f6b-f79c-4b38-8ed7-63a5f6d876ca

Timeline

Publicly Published
2022-09-01 (about 3 years ago)
Added
2022-09-15 (about 3 years ago)
Last Updated
2022-11-08 (about 3 years ago)

Other

Published
Title
Published
2024-04-10
Title
MihanPanel < 12.7 - Cross-Site Request Forgery
Published
2021-12-27
Title
AF Companion 1.1.0 - 1.1.2 - Arbitrary Plugin Installation & Activation via CSRF
Published
2023-08-11
Title
WooCommerce PDF Invoice Builder < 1.2.91 - Invoice Update via CSRF
Published
2025-06-05
Title
Booqable Rental <= 2.4.21 - Cross-Site Request Forgery
Published
2014-08-01
Title
A Forms 1.4.0 - Form Submission CSRF