CVE-2022-1611: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-1611 affects the WordPress plugin Bulk Page Creator versions below 1.1.4. This Cross-Site Request Forgery (CSRF) vulnerability was discovered and reported by Daniel Ruf on May 9, 2022. The vulnerability stems from the plugin's failure to implement proper nonce checks in its page creation functionalities (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, corresponding to CWE-352 and falling under the OWASP Top 10 category A2: Broken Authentication and Session Management. It received a CVSS score of 4.3 (medium severity). The technical issue arises from the absence of nonce checks in the page creation functionality, making it susceptible to CSRF attacks (WPScan).

The vulnerability allows attackers to perform arbitrary page creation actions on behalf of authenticated users without their consent. This could lead to unauthorized content creation and potential spam or malicious content being published on the affected WordPress sites (WPScan).

The vulnerability has been fixed in version 1.1.4 of the Bulk Page Creator plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).