CVE-2022-37344 HIGH

CVE-2022-37344: WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability

Vendor Php Crafts
Product Accommodation System (WordPress plugin)
Weakness CWE-264
Published September 6, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Accommodation System WordPress plugin version 1.0.1 and earlier contains an authorization flaw that allows authenticated users with low privileges to read sensitive data and make limited modifications to the site. An attacker with a standard user account can access information they should not be able to view and alter certain site settings. The vulnerability requires an active user account but no additional user interaction.

What an attacker can do

03Attacker Capabilities

Read sensitive data and make limited changes to site settings with a low-privilege user account.

Potential impact on your site

04Site Impact

Unauthorized users can access confidential information and modify site configuration, potentially exposing guest data or disrupting bookings.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account with low privileges; no user interaction required.

Key dates

06Disclosure timeline

September 6, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-35242 WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability CVE-2022-41132 WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability CVE-2022-33969 WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability CVE-2022-41839 WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability CVE-2021-36879 WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability