plugin

Core Control Vulnerabilities

2 known security issues reported for the Core Control WordPress plugin. Most recent disclosed Jan 16, 2024.

1 high

Running Core Control on your site? Check whether your installed version is affected.

Core Control [core-control] < 1.2.2 (closed)

unknown

[en] The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affected:: up to 1.2.2
Fixed in:: 1.2.2
Disclosed:: Jan 16, 2024

CVE-2022-1760 on NVD →

Core Control <= 1.2.1 - Cross-Site Request Forgery

high

The Core Control plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to update the plugin's settings granted they can trick a site a...

CVSS:: 8.8
Affected:: up to 1.2.1
Fixed in:: 1.2.2
Disclosed:: May 24, 2022

CVE-2022-1760 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database