PT-2022-24233 · Squirrly · Squirrly Seo Plugin

Rafie Muhammad + 1 · Published 2022-11-28 · Updated 2022-12-01 · CVE-2022-38140

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEO Plugin by Squirrly SEO plugin versions 12.1.10 and earlier

Description The issue concerns an arbitrary file upload vulnerability in the SEO Plugin by Squirrly SEO plugin, affecting WordPress. This vulnerability can be exploited by contributors and higher-privileged users.

Recommendations For versions 12.1.10 and earlier, update to a version later than 12.1.10 to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-38140

Affected Products

Squirrly Seo Plugin

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-38140 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38140 · Vendor Advisory
• https://t.me/cibsecurity/53597 · Telegram Post
• https://patchstack.com/database/vulnerability/squirrly-seo/wordpress-seo-plugin-by-squirrly-seo-plugin-12-1-10-auth-arbitrary-file-upload-vulnerability?_s_id=cve · Note