Main Vulnerability Database Vulnerabilities #VU69682

#VU69682 Improper access control in WPML Multilingual CMS - CVE-2022-38461

Published: November 29, 2022

Vulnerability identifier: #VU69682

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-38461

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
WPML Multilingual CMS

Software vendor:
OnTheGoSystems

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and change plugin settings (selected language for legacy widgets, the default behavior for media content).

Remediation

Install updates from vendor's website.

External links

https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-plugin-4-5-10-broken-access-control-vulnerability?_s_id=cve