Read the docs
TI-2022-00211 Aliases CVE-2022-0279GHSA-g7w5-4hph-r98m

AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition

Priority LOW 16CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users

Why it matters now

EPSS 0.00494 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed AnyComment (Unknown): 0.2.18

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAnyComment0.2.18 to before 0.2.180.2.18Patch availableCNA
  • AnyComment VendorUnknown Affected 0.2.18 to before 0.2.18 Fixed in 0.2.18 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bologer:anycomment:*:*:*:*:*:wordpress:*:*before 0.2.18VulnerableBologer
  • cpe:2.3:a:bologer:anycomment:*:*:*:*:*:wordpress:*:* Versions before 0.2.18 Vulnerable ·Bologer

Remediation

  • Fix · CNA AnyComment (Unknown) Fixed in 0.2.18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    AnyComment 0.2.18

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-00077 AnyComment < 0.2.18 - Arbitrary HyperComments Import/Revert via CSRFPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0279
  2. 2026-10-03 Alias added: GHSA-g7w5-4hph-r98m

References

Exploit 1

  • TI-2022-00077 AnyComment < 0.2.18 - Arbitrary HyperComments Import/Revert via CSRF CVSS 3.1HIGH 8.8
  • TI-2021-07120 AnyComment < 0.3.5 - Open Redirect CVSS 3.1MEDIUM 6.1
  • TI-2018-14963 The anycomment plugin before 0.0.33 for WordPress has XSS. CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences