CVE-2022-1251

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Ask me	>= 6.8.4, < 6.8.4

References

https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349Exploit, Third Party Advisory
https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349Exploit, Third Party Advisory

Timeline

Published: Aug 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-12529.1Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gn CVE-2022-12539.8Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e1 CVE-2022-12546.1A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prio CVE-2022-12554.8The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allo CVE-2022-12567.8A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges thr CVE-2022-12575.5Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain acces CVE-2022-12587.2A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated ad CVE-2022-12597.5A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial CVE-2022-12618.8Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to co CVE-2022-12627.8A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbit CVE-2022-12635.5A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged lo CVE-2022-12648.8The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code.