Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2022-3883: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authentic...
CVE-2022-3883 · published 3 years ago
Summary
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
What to do
- Update stopbadbots_project stopbadbots to version 7.24 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| stopbadbots_project | stopbadbots |
< 7.24 cpe:2.3:a:stopbadbots_project:stopbadbots:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authentic...
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
References
- https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544 Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
CWE-863Incorrect Authorization
Timeline
Published12 Dec 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-3883 · NVD
Track software like this
Free during beta