CVE-2022-35238 MEDIUM

CVE-2022-35238: WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability

Vendor Brinia
Product Awesome Filterable Portfolio (WordPress plugin)
Weakness CWE-264
Published September 23, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Awesome Filterable Portfolio WordPress plugin version 1.9.7 and earlier contains a vulnerability that allows unauthenticated attackers to modify site data and disrupt service. The plugin fails to properly validate or restrict access to certain functions, enabling attackers to alter content or cause the site to become unavailable without requiring authentication or user interaction.

What an attacker can do

03Attacker Capabilities

Modify site data and cause the site to become unavailable without logging in.

Potential impact on your site

04Site Impact

Site content can be altered and the site may become unavailable to visitors without warning.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication or user interaction required.

Key dates

06Disclosure timeline

September 23, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-38104 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability CVE-2021-36879 WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability CVE-2022-29423 WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability CVE-2022-29444 WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability CVE-2022-36387 WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability