Security readout for executives and security teams
Plain-English summary
CVE-2022-4218 lets an outside attacker abuse a logged-in WordPress administrator's browser to delete or copy Chained Quiz quizzes. It requires tricking an administrator into an action such as clicking a link, so it is not a standalone remote compromise, but it can disrupt or corrupt quiz content.
Executive priority
Treat this as a moderate WordPress content integrity issue. Prioritize remediation where quizzes are customer-facing, revenue-related, compliance-related, or operationally important. It is less urgent than unauthenticated server compromise, but admin-targeted CSRF can still cause visible business disruption.
Technical view
Chained Quiz for WordPress through version 1.3.2.4 lacks nonce validation in list_quizzes(), creating a CSRF issue. An unauthenticated attacker can trigger quiz deletion or copying through an administrator's authenticated session. CVSS is 5.4 with low integrity and availability impact, no confidentiality impact, and required user interaction.
Likely exposure
Exposure is limited to WordPress sites running Chained Quiz versions up to and including 1.3.2.4. Practical risk depends on administrator exposure to phishing or malicious links and the business importance of affected quizzes.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. It includes public vulnerability references, including a gist, but exploitation still requires administrator interaction through a forged request.
Researcher notes
Evidence supports CWE-352 CSRF caused by missing nonce validation in list_quizzes(). The affected range is stated as versions up to and including 1.3.2.4. The provided data does not establish active exploitation, a specific fixed version, or impact beyond quiz deletion and copying.
Mitigation direction
- Inventory WordPress sites for the Chained Quiz plugin.
- Confirm whether installed versions are 1.3.2.4 or older.
- Update the plugin following official WordPress or vendor guidance.
- Disable or remove the plugin if no trusted fix is available.
- Warn administrators about unexpected links while remediation is pending.
Validation and detection
- Check plugin inventory and version across WordPress environments.
- Review whether Chained Quiz is active on public or business-critical sites.
- Confirm administrative pages require nonce validation after update.
- Review logs for unexpected quiz deletions or duplications.
- Verify backups can restore affected quiz content if needed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-4218 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/49333c6b-58f6-4d5a-a605-46484160175a?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=CVE reference
- https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0eCVE reference
- https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4218CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.