CVE-2022-3622

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-362209.8Kiosk breakout (without quit password) in Safe Exam Browser (Windows) <3.4.0, which allows an attacker to achieve code execution via the bro CVE-2022-362216.5Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe fil CVE-2022-362228.4Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account ca CVE-2022-362236.1In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and CVE-2022-362248.8XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-362258.8EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add.CVE-2022-362267.2SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx.CVE-2022-362279.8In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th CVE-2022-362286.5Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the devi CVE-2022-36237.5A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_p CVE-2022-362319.8pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.CVE-2022-362335.5Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd.