TI-2022-01091 Aliases CVE-2022-1203 GHSA-q5pj-mjjc-c94j

Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update

LOW 22CWE-352Published 2022-05-30 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering, Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options

Why it matters now

EPSS 0.01009 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Content Mask (Unknown): 1.8.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Content Mask	before 1.8.4.1	1.8.4.1	Patch available	CNA

Content Mask VendorUnknown Affected before 1.8.4.1 Fixed in 1.8.4.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:content_mask_project:content_mask::::::wordpress::*	before 1.8.4.1	Vulnerable	Content Mask Project

cpe:2.3:a:content_mask_project:content_mask:*:*:*:*:*:wordpress:*:* Versions before 1.8.4.1 Vulnerable ·Content Mask Project

Remediation

Fix · CNA Content Mask (Unknown) Fixed in 1.8.4.1

Timeline

2026-10-02 Threatist record created from CVE-2022-1203
2026-10-03 Alias added: GHSA-q5pj-mjjc-c94j

References

Exploit 1

https://wpscan.com/vulnerability/3c9969e5-ca8e-4e5d-a482-c6b5c4257820

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences