What’s Vulnerable › Vulnerabilities

CVE-2022-4555: WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-16 · updated 2026-06-17
• Weakness: CWE-862

Description

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.

Affected products

• wpvar.com WP Shamsi (WordPress plugin): before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: wpvar.com WP Shamsi (WordPress plugin) 4.1.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077

Get alerted when CVE-2022-4555 or the next vulnerability affects your stack