CVE-2022-3206: passster_project passster
CVSS: 5.9v3.1MediumModified
Published 17-10-2022Last modified 14-05-2025
Vulnerability summary
CVE-2022-3206 is a medium (CVSS 5.9) vulnerability in passster_project passster. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.5.5.5.2.
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.57%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 17-10-2022PublishedVulnerability first disclosed.
- 14-05-2025Last modifiedVulnerability information updated.
Description
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 5.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSources3 sources · 5.3–5.9
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.09 pp
From 0.48% on 18-09-2026
18-09-202618-10-2026
EPSS score0.57%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Affected systems
Passster_project1 product
- passster< 3.5.5.5.2
Unknown1 product
- passster< 3.5.5.5.2
Wordpress1 product
- content-protector≤ 3.5.5.5.1 (fixed in 3.5.5.5.2)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7aExploitVDB EntryTechnical DescriptionThird Party Advisory