{"id":"CVE-2022-3097","state":"PUBLISHED","title":"LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF","description":"The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections.","publishedAt":"2022-10-25T00:00:00.000Z","updatedAt":"2025-05-07T20:13:11.951Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Plugin LBstopattack"],"affected":[{"vendor":"Unknown","product":"Plugin LBstopattack","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.3","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43"],"weaknesses":[],"ingestedAt":"2026-10-29T19:50:32.060Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/3xxx/CVE-2022-3097.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-3097","state":"PUBLISHED","datePublished":"2022-10-25T00:00:00.000Z","dateUpdated":"2025-05-07T20:13:11.951Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-09-02T00:00:00.000Z"},"containers":{"cna":{"title":"LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF","descriptions":[{"lang":"en","value":"The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections."}],"affected":[{"vendor":"Unknown","product":"Plugin LBstopattack","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.1.3","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2022-11-29T13:41:09.131Z"},"credits":[{"lang":"en","value":"Daniel Ruf","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/9ebb8318-ebaf-4de7-b337-c91327685a43","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:00:10.709Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-05-07T20:12:53.617775Z","id":"CVE-2022-3097","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-07T20:13:11.951Z"}}]}}}