CVE-2022-3880 — AntiHacker < 4.20 - Subscriber+ Arbitrary Plugin Installation

Description (CNA)

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Affected (CNA)

Vendor / product	Versions
Unknown / Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan	affected 0 before 4.20

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/24743c72-310f-41e9-aac9-e05b2bb1a14e

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/24743c72-310f-41e9-aac9-e05b2bb1a14e

CISA-ADP

No English description supplied.

No references supplied.