CVE-2022-1793

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-17945.5The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authoriCVE-2022-17959.8Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.CVE-2022-17967.8Use After Free in GitHub repository vim/vim prior to 8.2.4979.CVE-2022-17978.6A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell AutomatiCVE-2022-17986.5A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt toCVE-2022-17999.8Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted CVE-2022-18007.2The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data befCVE-2022-18017.5The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden iCVE-2022-18028.8If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution CVE-2022-18036.9Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-18045.5accountsservice no longer drops permissions when writting .pam_environmentCVE-2022-18058.1When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue co