PatchSiren cyber security CVE debrief
CVE-2022-50955 Wordpress CVE debrief
CVE-2022-50955 affects the WordPress Curtain plugin 1.0.2 and is described as a cross-site request forgery issue that can let an attacker toggle site maintenance mode by inducing an authenticated administrator to submit a forged request. The supplied corpus ties the issue to missing nonce validation on the options-general.php page and rates it Medium severity (CVSS 5.3).
- Vendor
- Wordpress
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-10
- Original CVE updated
- 2026-05-10
- Advisory published
- 2026-05-10
- Advisory updated
- 2026-05-10
Who should care
WordPress site administrators, security teams managing plugins, and anyone running or auditing the Curtain plugin should pay attention, especially if maintenance-mode changes are sensitive to uptime or availability.
Technical summary
The vulnerability is identified as CWE-352 (CSRF). According to the supplied description, the plugin accepts requests on options-general.php with curtain parameters that can activate or deactivate maintenance mode without proper nonce validation, allowing a forged request to succeed if an authenticated administrator is induced to submit it.
Defensive priority
Medium. The impact is limited to unauthorized maintenance-mode changes, but that can still disrupt availability or be used for nuisance or operational abuse on affected WordPress sites.
Recommended defensive actions
- Check whether the Curtain plugin is installed and in use on any WordPress instance.
- Remove or disable the plugin if it is not required.
- If the plugin must remain installed, verify whether a patched version is available and deploy it as soon as possible.
- Review WordPress admin controls for CSRF protections, including nonce validation on plugin settings actions.
- Monitor for unexpected maintenance-mode toggles and review recent administrator actions around options-general.php requests.
- Restrict administrative access to trusted accounts and reduce exposure of admin sessions where practical.
Evidence notes
The supplied NVD record and linked VulnCheck advisory describe a CSRF issue in Curtain 1.0.2 that can toggle maintenance mode via forged requests to options-general.php without valid nonce validation. The supplied corpus also identifies CWE-352 and a Medium CVSS 5.3 score. The CVE record in the supplied feed is dated 2026-05-10; that date is used only as the record timing context.
Official resources
Prepared from the supplied official and referenced corpus only, with no exploit code or reproduction steps included. The CVE record timing in the feed is 2026-05-10; that is not treated as the underlying vulnerability date.