CVE-2022-1818: 
WordPress vulnerability analysis and mitigation

The Multi-page Toolkit WordPress plugin through version 2.6 was identified with a security vulnerability (CVE-2022-1818) that was discovered and publicly disclosed on May 30, 2022. The vulnerability affects the plugin's settings update functionality, potentially exposing WordPress installations to Cross-Site Request Forgery (CSRF) attacks (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, identified as CWE-352. It received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The technical root cause stems from the absence of CSRF checks during settings updates, combined with inadequate sanitization and escaping of input data (NVD).

The vulnerability could allow attackers to manipulate plugin settings through a CSRF attack when a logged-in administrator accesses a malicious page. Due to the lack of proper sanitization and escaping, this could lead to Stored Cross-Site Scripting (XSS) attacks, potentially compromising the security of the WordPress installation (WPScan).

A proof of concept exploit has been documented involving a simple JavaScript command: document.getElementById("test").submit();. The vulnerability requires user interaction, specifically requiring an authenticated administrator to access a malicious page for the CSRF attack to be successful (WPScan).

As of the latest reports, there is no known fix available for this vulnerability. Users of the Multi-page Toolkit WordPress plugin version 2.6 or earlier should consider implementing additional security measures or potentially removing the plugin until a security update is available (WPScan).