CVE-2022-0229

PoC —

CVSS 3.1

8.1 high

EPSS

<1%p44

Published

Mar 21, 2022 (Mar 21, 2022)

Modified

Jun 17, 2026

Description

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

Vendors: miniorange
Products: google authenticator
Ecosystems: WordPress
Weakness: CWE-352, CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.