CVE-2022-4024

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Dec 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-402429.8MegaRAC Default Credentials VulnerabilityCVE-2022-402467.2A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence thCVE-2022-402485.4An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via foCVE-2022-40254.3Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an CVE-2022-402508.8An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - CVE-2022-402575.4An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a CVE-2022-402585.3AMI Megarac Weak password hashes for Redfish & APICVE-2022-402599.8MegaRAC Default Credentials VulnerabilityCVE-2022-402618.2An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - CVE-2022-402628.2A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to tCVE-2022-402637.8BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modiCVE-2022-402647.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versio
CVE-2022-4024: Medium severity, CVSS 6.5 | Vulnix