PT-2022-20738 · WordPress · Wordfence Security – Firewall & Malware Scan

Ori Gabriel · Published 2022-09-23 · Updated 2024-01-11 · CVE-2022-3144

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wordfence Security – Firewall & Malware Scan plugin for WordPress versions up to and including 7.6.0

Description The issue allows authenticated users with administrative privileges to inject malicious web scripts into a setting on the options page due to insufficient escaping on the stored value. This makes it possible for the malicious scripts to execute whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.

Recommendations For versions up to and including 7.6.0, update to a version later than 7.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the options page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3144

Affected Products

Wordfence Security – Firewall & Malware Scan

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-3144 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2022-3144 · Vendor Advisory
• https://t.me/cibsecurity/50327 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2022-3144 · Note
• https://wordpress.org/plugins/wordfence/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve · Note