CVE-2022-41781 MEDIUM

CVE-2022-41781: WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability

Vendor Maciej Bis

Product Permalink Manager Lite

Weakness CWE-264

Published November 18, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

Permalink Manager Lite version 2.2.20 and earlier contains a vulnerability that allows an attacker to modify site content and disrupt service without authentication. The flaw stems from insufficient access controls on core functionality. Site administrators should update to a version newer than 2.2.20 immediately.

What an attacker can do

03Attacker Capabilities

Modify site content and cause service disruption without logging in.

Potential impact on your site

04Site Impact

Attackers can alter permalinks and content availability, potentially breaking site navigation and SEO.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 18, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-41781 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/264.html AskarLabs — CWE-264 write-up Permissions, Privileges, and Access Controls

Related vulnerabilities

Identifiers

CVE CVE-2022-41781

CWE CWE-264

CVSS 6.5 / MEDIUM

Affected versions