CVE-2022-50955
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.
Risk Assessment
An attacker can unauthorizedly toggle the site into or out of maintenance mode, potentially disrupting site operation or exposing it to attacks.
Recommendation
Update the Curtain plugin to the latest version or remove it if not essential. Implement CSRF protections (e.g., nonces) in all forms.
Original NVD description (English source)
WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.