Headline
CVE-2022-45369: WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability - Patchstack
Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.
Verified
Fixed
4.3
CVSS 3.1 score Medium severity
Report
Monitoring Not reported to be exploited
Vulnerable versions
<= 2.2.2
PSID
6cdbd5d983bf
Classification
Other Vulnerability Type
OWASP Top 10
A5: Broken Access Control
Required privilege
Requires subscriber or higher role user authentication.
Publicly disclosed
2022-11-18
Details
Auth. Broken Access Control vulnerability leading to arbitrary feed creation discovered by Tien Nguyen Anh (Patchstack Alliance) in the WordPress Plugin for Google Reviews plugin (versions <= 2.2.2).
Solution
Update the WordPress Plugin for Google Reviews plugin to the latest available version (at least 2.2.3).
References