Vulnerability Description
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thimpress | Learnpress | < 4.1.7.2 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/acea7a54-a964-4127-a93f-f38f883074e3ExploitThird Party Advisory
- https://wpscan.com/vulnerability/acea7a54-a964-4127-a93f-f38f883074e3ExploitThird Party Advisory
FAQ
What is CVE-2022-3360?
CVE-2022-3360 is a vulnerability with a CVSS score of 8.1 (HIGH). The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is pre...
How severe is CVE-2022-3360?
CVE-2022-3360 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3360?
Check the references section above for vendor advisories and patch information. Affected products include: Thimpress Learnpress.