{"id":"CVE-2022-0993","aliases":["EUVD-2022-15986","GHSA-24fr-xcq3-rqjr"],"status":"published","title":"SiteGround Security \u003c= 1.2.5 - Authorization Weakness to Authentication Bypass","description":"The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.07538,"percentile":0.94548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285","CWE-287","CWE-306"],"published":"2022-04-19T20:26:36Z","modified":"2026-06-17T04:21:36Z","products":[{"vendor":"siteground","product":"security optimizer – the all-in-one protection plugin"},{"vendor":"siteground","product":"siteground_security"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c93-e59abf913d04?source=cve","tags":["x_transferred"]},{"url":"https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/","tags":["x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/2706302","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0993"},{"url":"https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin"},{"url":"https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin"},{"url":"https://github.com/advisories/GHSA-24fr-xcq3-rqjr"}],"sources":{"cve":[{"id":"CVE-2022-0993","title":"SiteGround Security \u003c= 1.2.5 - Authorization Weakness to Authentication Bypass","description":"The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.","status":"published","published":"2022-04-19T20:26:36Z","modified":"2026-04-08T17:06:18.657Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15986","description":"The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.","status":"published","published":"2022-04-19T20:26:36Z","modified":"2026-04-08T17:06:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:49.853218Z"}],"ghsa":[{"id":"GHSA-24fr-xcq3-rqjr","title":"The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows...","description":"The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.","status":"published","published":"2022-04-20T00:00:31Z","modified":"2026-04-08T18:33:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-285","CWE-287","CWE-306"],"updated_at":"2026-11-02T15:07:13.380693Z"}],"nvd":[{"id":"CVE-2022-0993","description":"The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.","status":"published","published":"2022-04-19T21:15:13.683Z","modified":"2026-06-17T04:21:36.65Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-285","CWE-306"],"updated_at":"2026-11-02T14:07:16.9948Z"}]}}