{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","vendor":"Unknown","versions":[{"lessThan":"3.3.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:iubenda:iubenda-cookie-law-solution:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"62755C01-E9C3-4C61-B6AA-A57E5C6049BC","versionEndExcluding":"3.3.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc"},{"lang":"es","value":"El complemento iubenda de WordPress en sus versiones anteriores a la 3.3.3 no tiene autorización ni CSRF en una acción AJAX, y no asegura que las opciones a actualizar pertenezcan al complemento siempre que sean arrays. Como resultado, cualquier usuario autenticado, como el suscriptor, puede otorgarse a sí mismo cualquier privilegio, como edit_plugins, etc."}],"id":"CVE-2022-3911","lastModified":"2026-06-17T05:00:33.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-3911","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-04-10T18:34:20.340715Z","version":"2.0.3"}}]},"published":"2023-01-02T22:15:15.627","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}