« Volver al listado

CVE-2022-2172

Estado: ModificadaMedia (4.3)—

El plugin LinkWorth de WordPress versiones anteriores a 3.3.4, no implementa comprobaciones de nonce, lo que podría permitir a atacantes hacer que un administrador conectado cambie la configuración por medio de un ataque de tipo CSRF.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linkworth — Linkworth

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2172",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "LinkWorth Plugin",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.4",
              "lessThan": "3.3.4",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-22T15:15:14.267",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/changeset?new=2754739%40linkworth-wp-plugin&old=2750802%40linkworth-wp-plugin#file8",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/bfb6ed12-ae64-4075-9d0b-5620e998df74",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset?new=2754739%40linkworth-wp-plugin&old=2750802%40linkworth-wp-plugin#file8",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/bfb6ed12-ae64-4075-9d0b-5620e998df74",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack."
    },
    {
      "lang": "es",
      "value": "El plugin LinkWorth de WordPress versiones anteriores a 3.3.4, no implementa comprobaciones de nonce, lo que podría permitir a atacantes hacer que un administrador conectado cambie la configuración por medio de un ataque de tipo CSRF."
    }
  ],
  "lastModified": "2026-06-17T04:41:26.283",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linkworth:linkworth:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "410DED7E-64E2-48CD-BC4F-ADA0B5F39ADD",
              "versionEndExcluding": "3.3.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}