blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1589

HIGH 7.5 CVSS 3.1
Published
May 30, 2022
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
contact@wpscan.com
Weakness
CWE-352, CWE-863
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector

Affected products and versions

  • Unknown Change wp-admin login — Before 1.1.0
  • wpexperts all_in_one_login — Before 1.1.0

References

  • wpscan.com https://wpscan.com/vulnerability/257f9e14-4f43-4852-8384-80c15d087633 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record