CVE-2022-3538

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p30

Published

Nov 14, 2022 (Nov 14, 2022)

Modified

Jun 17, 2026

Description

The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins

Vendors: webmaster tools verification project
Products: webmaster tools verification
Ecosystems: WordPress
Weakness: CWE-352, CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.