Security Advisory

CVE-2022-4555

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2022-12-16 13:54:19

Last updated 2026-04-08 17:02:29

Assigner Wordfence

State PUBLISHED

Description

The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.

← Browse all CVEs View on cve.org ↗