PT-2022-18731 · WordPress · Affiliates Manager

Nhatnam · Published 2022-09-16 · Updated 2022-09-20 · CVE-2022-2798

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Affiliates Manager WordPress plugin versions prior to 2.9.14

Description The issue concerns the lack of validation and sanitization of affiliate data, which could allow users registering as affiliates to perform CSV injection attacks against an admin exporting the data.

Recommendations For versions prior to 2.9.14, update to version 2.9.14 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-2798

Affected Products

Affiliates Manager

References · 4

• 🔥 https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2798 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2798 · Vendor Advisory
• https://t.me/cibsecurity/49864 · Telegram Post