CVE-2022-1599: Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-11 · updated 2026-06-17
Weakness: CWE-352

Description

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.

Affected products

Oliver Schlöbe Admin Management Xtended (WordPress plugin): before 2.4.5 — fixed in 2.4.5

How to fix

Upgrade to a fixed version: Oliver Schlöbe Admin Management Xtended (WordPress plugin) 2.4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-1599 or the next vulnerability affects your stack