PT-2022-15138 · WordPress · Greyd.Suite

Bernhard Kau · Published 2022-08-15 · Updated 2022-08-16 · CVE-2022-2180

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GREYD.SUITE WordPress theme (affected versions not specified)

Description The issue concerns the GREYD.SUITE WordPress theme, which fails to properly validate uploaded custom font packages and does not perform authorization or CSRF checks. This allows an unauthenticated attacker to upload arbitrary files, including PHP source files, potentially leading to remote code execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-2180

Affected Products

Greyd.Suite

References · 3

• 🔥 https://wpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2180 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2180 · Vendor Advisory