CVE-2022-3342

The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/browser/zero-bs-crm/trunk/includes/ZeroBSCRM.CSVImporter.php?rev=2790863Patch
• https://plugins.trac.wordpress.org/changeset/2805282/zero-bs-crm/trunk/includes/ZeroBSCRM.CSVImporter.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/98ab264f-b210-41d0-bb6f-b4f31d933f80?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/zero-bs-crm/trunk/includes/ZeroBSCRM.CSVImporter.php?rev=2790863Patch
• https://plugins.trac.wordpress.org/changeset/2805282/zero-bs-crm/trunk/includes/ZeroBSCRM.CSVImporter.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/98ab264f-b210-41d0-bb6f-b4f31d933f80?source=cveThird Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3336The Event Monster WordPress plugin before 1.2.0 does not hav…4.3
• CVE-2022-3337It was possible for a user to delete a VPN profile from WARP…8.5
• CVE-2022-3338An External XML entity (XXE) vulnerability in ePO prior to 5…5.4
• CVE-2022-3339A reflected cross-site scripting (XSS) vulnerability in ePO …6.1
• CVE-2022-3340XML External Entity (XXE) vulnerability in Trellix IPS Manag…7.2
• CVE-2022-3341A null pointer dereference issue was discovered in 'FFmpeg' …5.3
• CVE-2022-3343The WPQA Builder WordPress plugin before 5.9.3 (which is a c…3.5
• CVE-2022-3344A flaw was found in the KVM's AMD nested virtualization (SVM…5.5
• CVE-2022-3346DNSSEC validation is not performed correctly. An attacker ca…6.5
• CVE-2022-3347DNSSEC validation is not performed correctly. An attacker ca…7.5
• CVE-2022-3348Just like in the previous report, an attacker could steal th…4.9
• CVE-2022-3349A vulnerability was found in Sony PS4 and PS5. It has been c…6.8