Cyber Resilience

CVE-2022-1580

MediumPublic PoC

Published: 19 September 2022

Published
19 September 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.1512 94.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-1580 is a medium-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Freehtmldesigns Site Offline. Its CVSS base score is 4.3 (Medium).

Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before version 1.5.3 is affected by an authorization bypass vulnerability tracked as CVE-2022-1580. The plugin is designed to block visitor access to a site during maintenance or similar states, yet it fails to enforce this restriction when certain keywords appear in the URL query string, allowing the core access-control feature to be circumvented.

An attacker with low privileges can exploit the flaw by crafting requests that include the bypass keywords in the query string. This grants the ability to reach otherwise restricted content, resulting in limited information disclosure without requiring user interaction or elevated permissions.

The vulnerability is addressed by updating the plugin to version 1.5.3 or later, as noted in the available references. The associated EPSS score has remained flat at 0.1512 with no material increase after disclosure.

EU & UK References

Vulnerability details

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass…

more

the plugin's main feature.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

freehtmldesigns
site offline
≤ 1.5.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-639

Per-request decision making makes it harder to bypass authorization using user-controlled keys without proper validation in the decision process.

addresses: CWE-639

Consistent enforcement of approved authorizations makes bypassing via user-controlled keys ineffective.

References