CVE-2022-1779

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Auto Delete Posts	>= 1.3.0, <= 1.3.0

References

https://wpscan.com/vulnerability/45117646-88ff-41d4-8abd-e2f18d4b693eExploit, Third Party Advisory
https://wpscan.com/vulnerability/45117646-88ff-41d4-8abd-e2f18d4b693eExploit, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17805.4The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to m CVE-2022-17815.4The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to ma CVE-2022-17826.1Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.CVE-2022-17832.7An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 befor CVE-2022-17847.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.CVE-2022-17857.8Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.CVE-2022-17867.8A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more CVE-2022-17875.4The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make CVE-2022-17886.5Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to CVE-2022-17896.8With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invl CVE-2022-17906.5The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow att CVE-2022-17918.1The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow