CVE-2022-4745

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Affected software

VendorProductVersions
UnknownWP Customer Area< 8.1.4

References

Timeline

Published
Feb 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-474505.5In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.CVE-2022-474515.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-474525.5In gnss driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan seCVE-2022-474535.5In wcn service, there is a possible missing params check. This could lead to local denial of service in wcn service.CVE-2022-474545.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-474555.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-474565.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-474575.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-474585.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-474595.5In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.CVE-2022-47467.5The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, whCVE-2022-474605.5In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
CVE-2022-4745: High severity, CVSS 7.1 | Vulnix