« Volver al listado

CVE-2022-32587

Estado: ModificadaMedia (4.3)—

Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento CodeAndMore WP Page Widget de WordPress en versiones <= 3.9, lo que provoca un cambio en la configuración del complemento.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Codeandmore — WP Page Widget

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-32587",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-32587",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-20T19:21:11.044789Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "audit@patchstack.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "audit@patchstack.com",
      "affectedData": [
        {
          "vendor": "CodeAndMore",
          "product": "WP Page Widget (WordPress plugin)",
          "versions": [
            {
              "status": "affected",
              "version": "<= 3.9",
              "versionType": "custom",
              "lessThanOrEqual": "3.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-08T19:15:12.453",
  "references": [
    {
      "url": "https://patchstack.com/database/vulnerability/wp-page-widget/wordpress-wp-page-widget-plugin-3-9-cross-site-request-forgery-csrf-vulnerability",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://wordpress.org/plugins/wp-page-widget/",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/wp-page-widget/wordpress-wp-page-widget-plugin-3-9-cross-site-request-forgery-csrf-vulnerability",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/plugins/wp-page-widget/",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "audit@patchstack.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento CodeAndMore WP Page Widget de WordPress en versiones &lt;= 3.9, lo que provoca un cambio en la configuración del complemento."
    }
  ],
  "lastModified": "2026-06-17T04:47:36.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codeandmore:wp_page_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1DEDA7C-CA7E-4ABB-BFBF-F86358FBB50C",
              "versionEndExcluding": "4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "audit@patchstack.com"
}