QID 150499

Date Published: 2022-04-13

QID 150499: WordPress AnyComment Plugin: Comment Rating Increase/Decrease via Race Condition Vulnerability (CVE-2022-0279)

AnyComment is a plugin for WordPress, it allows users to easily add their comments via social networks.

The plugin is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users.

Affected Versions:
AnyComment WordPress plugin before 0.2.18

QID Detection Logic:
This QID sends an HTTP GET request and retrieves a vulnerable version of the AnyComment plugin running on the target application.

Successful exploitation could allow an authenticated user to quickly raise their rating or lower the rating of other users.

CVSS V3 rated as Medium - 3.1 severity.

CVSS V2 rated as Medium - 3.5 severity.

Solution

Customers are advised to upgrade to AnyComment 0.2.18 or later version to remediate this vulnerability. For more information regarding this vulnerability please refer WPScan.

Vendor References

WPScan - wpscan.com/vulnerability/43a4b2d3-1bd5-490c-982c-bb7120595865

CVEs related to QID 150499

CVE-2022-0279 |

Software Advisories

Advisory ID	Software	Component	Link
WPScan			wpscan.com/vulnerability/43a4b2d3-1bd5-490c-982c-bb7120595865
WordPress			wordpress.org/plugins/anycomment/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].