PatchTheCVECVE-2022-1663: The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token
CVE-2022-1663 is a medium-severity flaw (CVSS 6.5) affecting stop spam comments. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.7% (top 48%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2022-08-29 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-1663?
stop spam comments: upgrade to newer than 0.2.1.2. Exact commands for each OS are on this page.
Is CVE-2022-1663 being exploited?
CVE-2022-1663 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-1663 affect?
CVE-2022-1663 affects stop spam comments. Severity is medium (CVSS 6.5). The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
How urgent is CVE-2022-1663?
Priority 46/100. Public exploit reference; Remotely exploitable, no login, no user action