CVE-2022-4950
Last modified
CVE-2022-4950 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.. EPSS estimates a 1.38% chance of exploitation in the next 30 days.
Description
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Coolplugins | Cool Timeline | < 2.4 |
| Coolplugins | Cryptocurrency Widgets | < 2.5.1 |
| Coolplugins | Cryptocurrency Widgets For Elementor | < 1.3 |
| Coolplugins | Event Single Page Builder For The Event Calendar | < 1.6 |
| Coolplugins | Events-Notification-Bar-Addon | < 1.6 |
| Coolplugins | Events Search For The Events Calendar | < 1.2 |
| Coolplugins | Events Shortcodes For The Events Calendar | < 2.0 |
| Coolplugins | Events Widgets For Elementor And The Events Calendar | < 1.5 |
| Coolplugins | The Events Calendar Countdown Addon | < 1.4 |
| Cryptocurrency Payment \& Donation Box Plugins | Cryptocurrency Payment \& Donation Box | < 1.8 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cveBroken Link, Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cveBroken Link, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-4950?
How severe is CVE-2022-4950?
How do I fix CVE-2022-4950?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-49494In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49495In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49496In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49497In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49498In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49499In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49500In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49501In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-49502In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49503In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2022-49504In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-49505In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2022-4950?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST