CVE-2022-36404: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-36404 affects the WordPress Simple SEO plugin versions 1.8.12 and earlier. It was identified as a Missing Authorization and Cross-Site Request Forgery (CSRF) vulnerability. The issue was discovered and reported by Mika, with the vulnerability being published on October 20, 2022 (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS severity rating of Medium (5.4). The security flaw stems from missing authorization, authentication, or nonce token checks in certain functions, potentially allowing unprivileged users to execute higher privileged actions (Patchstack).

The vulnerability is considered moderately dangerous and expected to become exploited. It could allow unauthorized users with subscriber-level access to perform actions that should be restricted to users with higher privilege levels (Patchstack).

The vulnerability has been fixed in version 1.8.13 of the Simple SEO plugin. Users are advised to update to version 1.8.13 or later to resolve the vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).