CVE-2022-36387 HIGH

CVE-2022-36387: WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability

Vendor Alessio Caiazza
Product About Me (WordPress plugin)
Weakness CWE-264
Published September 6, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The About Me WordPress plugin through version 1.0.12 contains an authorization flaw that allows authenticated users to read sensitive data and modify site content. An attacker with a low-privilege account can access information they should not see and make limited changes to the site. The vulnerability requires a valid WordPress user account to exploit.

What an attacker can do

03Attacker Capabilities

Read sensitive data and make limited modifications to site content with a low-privilege WordPress account.

Potential impact on your site

04Site Impact

Authenticated users with low privileges can access confidential information and alter site data beyond their intended permissions.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege WordPress user account; no user interaction required.

Key dates

06Disclosure timeline

September 6, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-38058 WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability CVE-2022-34149 WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability CVE-2022-41781 WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability CVE-2022-42461 WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability CVE-2022-36793 WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities