Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-2184

CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown CAPTCHA 4WP

  • 7.1.0 to < 7.1.0affected

References