CVE-2022-3359

Shortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection

CVSS 8.8 HIGHEPSS 0.7%

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

12 Dec 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Unknown · Shortcodes and extra features for Phlox theme

References

https://wpscan.com/vulnerability/08f3ce22-94a0-496a-aaf9-d35b6b0f5bb6