CVE-2022-1788

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17896.8With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invl CVE-2022-17906.5The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow att CVE-2022-17918.1The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow CVE-2022-17925.4The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-17934.3The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a l CVE-2022-17945.5The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authori CVE-2022-17959.8Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.CVE-2022-17967.8Use After Free in GitHub repository vim/vim prior to 8.2.4979.CVE-2022-17978.6A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automati CVE-2022-17986.5A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to CVE-2022-17999.8Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted CVE-2022-18007.2The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data bef