Vulnerabilities > CVE-2022-4555 - Unspecified vulnerability in Wpvar WP Shamsi

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

wpvar

NVD

Published: 2022-12-16

Updated: 2024-11-21

Summary

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.

Vulnerable Configurations

Part	Description	Count
Application	Wpvar Wpvar WP Shamsi - Wpvar WP Shamsi 1.0.0 Wpvar WP Shamsi 1.2.0 Wpvar WP Shamsi 1.2.1 Wpvar WP Shamsi 2.0.0 Wpvar WP Shamsi 2.0.1 Wpvar WP Shamsi 2.0.2 Wpvar WP Shamsi 2.1.0 Wpvar WP Shamsi 2.1.1 Wpvar WP Shamsi 2.1.2 Wpvar WP Shamsi 2.1.3 Wpvar WP Shamsi 2.1.4 Wpvar WP Shamsi 3.0.0 Wpvar WP Shamsi 3.0.1 Wpvar WP Shamsi 3.0.2 Wpvar WP Shamsi 3.1.0 Wpvar WP Shamsi 3.1.1 Wpvar WP Shamsi 4.0.0 Wpvar WP Shamsi 4.0.1 Wpvar WP Shamsi 4.1.0	20

Summary

Vulnerable Configurations

References