CVE-2022-38104

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
Biplob Adhikari	Accordions – Multiple Accordions or FAQs Builder (WordPress plugin)	>= <= 2.0.3, <= 2.0.3

References

https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-authenticated-wordpress-options-change-vulnerability?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/accordions-or-faqs/#developersProduct, Third Party Advisory
https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-authenticated-wordpress-options-change-vulnerability?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/accordions-or-faqs/#developersProduct, Third Party Advisory

Timeline

Published: Oct 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-381057.5An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configura CVE-2022-381065.4This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function.CVE-2022-381075.3Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental de CVE-2022-381087.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-38114.8The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high pri CVE-2022-381105.4In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site CVE-2022-381117.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-CVE-2022-381127.5In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.CVE-2022-381135.3This vulnerability discloses build and services versions in the server response header.CVE-2022-381146.1This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request sm CVE-2022-381155.3Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT CVE-2022-381169.8Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticate