CVE-2022-42459 HIGH

CVE-2022-42459: WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

Vendor Biplob Adhikari

Product Image Hover Effects Ultimate (WordPress plugin)

Weakness CWE-264

Published November 18, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

Image Hover Effects Ultimate versions up to 9.7.1 contain an authorization flaw that allows high-privileged users to read sensitive data, modify site content, or disrupt service. The vulnerability requires administrator-level access and network connectivity. Site owners should update to a version newer than 9.7.1 immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, or disrupt service if they have admin-level access.

Potential impact on your site

04Site Impact

A compromised admin account could be used to steal data, alter pages, or take the site offline.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level privileges on the WordPress site.

Key dates

06Disclosure timeline

November 18, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-42459 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/264.html AskarLabs — CWE-264 write-up Permissions, Privileges, and Access Controls

Related vulnerabilities

Identifiers

CVE CVE-2022-42459

CWE CWE-264

CVSS 7.2 / HIGH

Affected versions