Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-0593
CVE-2022-0593:
WordPress vulnerability analysis and mitigation
Overview
The vulnerability CVE-2022-0593 affects the WordPress plugin 'Login with phone number' versions prior to 1.3.7. This security flaw was discovered and publicly disclosed on February 16, 2022. The vulnerability allows unauthenticated users to remotely delete plugin files, potentially leading to a Denial of Service situation (WPScan).
Technical details
The vulnerability exists due to a file named 'delete.php' being included in the plugin directory without any authentication or authorization checks. This implementation flaw is classified as a File Deletion vulnerability and falls under the OWASP Top 10 category A6: Security Misconfiguration. The vulnerability has been assigned a CVSS score of 5.3 (medium) and is associated with CWE-73 (WPScan).
Impact
When exploited, this vulnerability allows an unauthenticated attacker to remotely delete the plugin files from the WordPress installation. This can result in a Denial of Service condition by disabling the plugin's functionality on the affected website (WPScan).
Mitigation and workarounds
The vulnerability has been fixed in version 1.3.7 of the Login with phone number plugin. Website administrators should update to this version or later to protect against this security issue. The fix includes removing the delete.php file and adding proper security checks (WPScan).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management