{"id":"CVE-2022-4024","state":"PUBLISHED","title":"Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion","description":"The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)","publishedAt":"2022-12-19T13:41:40.069Z","updatedAt":"2025-04-17T14:15:50.693Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Registration Forms"],"affected":[{"vendor":"Unknown","product":"Registration Forms","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.8.1.3","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/4xxx/CVE-2022-4024.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-4024","state":"PUBLISHED","datePublished":"2022-12-19T13:41:40.069Z","dateUpdated":"2025-04-17T14:15:50.693Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","requesterUserId":"dc9e157c-ddf1-4983-adaf-9f01d16b5e04","dateReserved":"2022-11-16T15:45:06.978Z"},"containers":{"cna":{"title":"Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion","descriptions":[{"lang":"en","value":"The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)"}],"affected":[{"vendor":"Unknown","product":"Registration Forms","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.8.1.3","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]},{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2022-12-19T13:41:40.069Z"},"credits":[{"lang":"en","value":"cydave","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:27:54.143Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-17T14:15:20.236608Z","id":"CVE-2022-4024","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-17T14:15:50.693Z"}}]}}}