CVE-2022-0164: unknown coming soon and maintenance mode Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2022-0164 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in unknown coming soon and maintenance mode. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.6.7.

Timeline

1. 21-02-2022
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.