CVE-2022-1631

CVE-2022-1631 describes a critical pre-account takeover vulnerability affecting Microweber CMS versions prior to 1.2.15. Attackers can register an account using a victim's email address due to a lack of email confirmation and inadequate validation during social logins, effectively gaining control over the victim's future or existing account. This vulnerability carries a high CVSS score of 8.8, indicating high confidentiality, integrity, and availability impacts, with low attack complexity and no user interaction required. While not actively exploited in the wild, public exploit code exists on ExploitDB, and its EPSS score suggests a higher-than-average likelihood of exploitation. Despite the availability of exploit code, there is currently no significant community discussion or media coverage surrounding this vulnerability.