CVE-2022-35242 MEDIUM

CVE-2022-35242: WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability

Vendor 59Sec
Product THE Leads Management System: 59sec LITE (WordPress plugin)
Weakness CWE-264
Published August 23, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The 59sec LITE WordPress plugin version 3.4.1 and earlier contains a flaw that allows unauthenticated attackers to modify data or disrupt service through the network. No special access or user interaction is required. Site administrators should update to a version newer than 3.4.1 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Modify plugin data or cause the site to become unavailable without needing to log in.

Potential impact on your site

04Site Impact

Attackers can alter plugin settings or cause service disruption without any site credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 23, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-42460 WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) CVE-2022-29423 WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability CVE-2022-38058 WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability CVE-2022-35238 WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability CVE-2022-41839 WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability