CVE-2022-0993 HIGH

CVE-2022-0993: SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass

Vendor Siteground
Product Security Optimizer – The All-In-One Protection Plugin
Weakness CWE-285
Published April 19, 2022
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.

Key dates

02Disclosure timeline

April 19, 2022 CVE published
April 8, 2026 Record updated