PT-2022-24711 · WordPress · Clerk

Francesco Carlucci · Published 2022-12-05 · Updated 2025-04-23 · CVE-2022-3907

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Clerk WordPress plugin versions prior to 4.0.0

Description The issue affects the validation function for all API requests, making it vulnerable to time-based attacks due to the usage of comparison operators to verify API keys against the ones stored in the site options.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints that use the vulnerable validation function until a patch is available.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2022-3907

Affected Products

Clerk

References · 6

• 🔥 https://wpscan.com/vulnerability/7920c1c1-709d-4b1f-ac08-f0a02ddb329c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3907 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3907 · Vendor Advisory
• https://t.me/cvenotify/119535 · Telegram Post
• https://t.me/cibsecurity/54005 · Telegram Post
• https://t.me/cvenotify/55018 · Telegram Post