Security readout for executives and security teams
Plain-English summary
CVE-2022-3427 affects the WordPress Corner Ad plugin through version 1.0.56. A malicious site or link could cause a logged-in administrator’s browser to delete ads without proper authorization checks. The business impact is disruption or manipulation of advertising content, but exploitation requires administrator interaction.
Executive priority
Treat this as a high-priority WordPress plugin hygiene issue where Corner Ad is installed. It is not currently evidenced as actively exploited in the supplied sources, but administrator-assisted CSRF can still disrupt site advertising content.
Technical view
The issue is CWE-352 CSRF in Corner Ad’s corner_ad_settings_page function, caused by missing or incorrect WordPress nonce validation. The CVSS v3.1 score is 8.8. The supplied description states unauthenticated attackers can trigger ad deletion if they trick a site administrator into performing an action.
Likely exposure
Exposure is likely limited to WordPress sites with the Corner Ad plugin installed at version 1.0.56 or earlier. Sites not using this plugin are not affected by the supplied evidence.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires a logged-in site administrator to be tricked into interacting with a forged request.
Researcher notes
Key evidence is the CVE description, Wordfence advisory, and WordPress plugin Trac references. The bundle indicates affected versions through 1.0.56 and a nonce-validation weakness, but does not provide active exploitation evidence or a clearly named fixed version.
Mitigation direction
- Inventory WordPress sites for Corner Ad versions 1.0.56 or earlier.
- Update Corner Ad beyond 1.0.56 if a fixed vendor release is available.
- Disable or remove the plugin where it is unnecessary.
- Restrict administrator browsing from logged-in WordPress sessions where practical.
- Monitor vendor and WordPress plugin guidance for confirmed remediation details.
Validation and detection
- Confirm whether Corner Ad is installed on each WordPress site.
- Record the installed plugin version and compare it with 1.0.56.
- Review the settings handler for nonce validation before destructive actions.
- Check WordPress activity records for unexpected ad deletion events.
- Verify the deployed plugin matches the intended fixed or removed state.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-3427 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6c5e9a-754f-41c8-b27b-caa133b5070f?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2765630%40corner-ad%2Ftrunk&old=2719671%40corner-ad%2Ftrunk&sfp_email=&sfph_mail=CVE reference
- https://plugins.trac.wordpress.org/browser/corner-ad/trunk/corner-ad.php?rev=2782613#L240CVE reference
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6c5e9a-754f-41c8-b27b-caa133b5070fCVE reference · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.