PT-2022-15412 · WordPress · Featured Image From Url

Raad Haddad · Published 2022-08-01 · Updated 2023-07-04 · CVE-2022-2241

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Featured Image from URL (FIFU) WordPress plugin versions prior to 4.0.1

Description The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Additionally, due to the lack of validation, sanitisation, and escaping in some settings, it could also lead to Stored XSS issues.

Recommendations For versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings update functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-2241

Affected Products

Featured Image From Url

References · 5

• 🔥 https://wpscan.com/vulnerability/8670d196-972b-491b-8d9b-25994a345f57 · Exploit
• https://osv.dev/vulnerability/CVE-2022-2241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2241 · Security Note
• https://t.me/cibsecurity/47309 · Telegram Post
• https://t.me/cvenotify/34329 · Telegram Post