CVE-2022-3880

CVE-2022-3880 affects the Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin prior to version 4.20. The vulnerability stems from improper authorization and Cross-Site Request Forgery (CSRF) in an AJAX action. This allows any authenticated user, even a subscriber, to install and activate arbitrary plugins from wordpress.org. Rated Medium severity with a CVSS score of 6.5, the attack vector is network-based with low attack complexity, requiring user interaction. The potential impact is high integrity, as an attacker could gain control over the website by installing malicious plugins. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the typical lack of attention for most vulnerabilities.