CVE-2022-3911: iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Admin

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-02 · updated 2026-06-17
Weakness: CWE-352

Description

The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc

Affected products

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: before 3.3.3 — fixed in 3.3.3

How to fix

Upgrade to a fixed version: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more 3.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3911 or the next vulnerability affects your stack