CVE-2022-3679
Last modified
CVE-2022-3679 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.. EPSS estimates a 0.92% chance of exploitation in the next 30 days.
Description
The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kadencewp | Starter Templates | <= 1.2.17 |
References
- https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3679?
How severe is CVE-2022-3679?
How do I fix CVE-2022-3679?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-36784 Elsight – Elsight Halo Remote Code Execution (RCE) Elsight…9.8
- CVE-2022-36785 D-Link – G integrated Access Device4 Information Disclosure…7.5
- CVE-2022-36786DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 ha…9.9
- CVE-2022-36787 webvendome - webvendome SQL Injection. SQL Injection in the…9.8
- CVE-2022-36788A heap-based buffer overflow vulnerability exists in the Tri…7.8
- CVE-2022-36789Improper access control in BIOS firmware for some Intel(R) N…7.8
- CVE-2022-36791Authenticated (contributor+) Stored Cross-Site Scripting (XS…5.4
- CVE-2022-36792Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-36793Unauthenticated Plugin Settings Change & Data Deletion vulne…9.1
- CVE-2022-36794Improper condition check in some Intel(R) SPS firmware befor…4.4
- CVE-2022-36795In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.…7.5
- CVE-2022-36796Cross-Site Request Forgery (CSRF) vulnerability leading to S…6.1
Are you affected by CVE-2022-3679?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST