CVE-2022-0363: unknown mycred Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2022-0363 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in unknown mycred. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.6% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.4.4.
Timeline
- 25-04-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191ExploitVDB EntryTechnical DescriptionThird Party Advisory