Skip to content
Sign in
3.1 Low

CVE-2022-4309 The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers…

Description

The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.

Affected products and versions

Product Affected versions Fixed in
Subscribe2 10.38 earliest → < 10.38 10.38

Other CVEs of Subscribe2

The 2 CVEs of Subscribe2 →
CVE-2026-14331 The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a… 6.1 Medium
Track this CVE