PT-2022-24810 · WordPress · Listingo

Fioravante Souza · Published 2022-12-12 · Updated 2022-12-14 · CVE-2022-3921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Listingo WordPress theme versions prior to 3.2.7

Description The issue concerns the lack of file validation for uploads via an AJAX action that is accessible to unauthenticated users. This could allow attackers to upload arbitrary files, potentially leading to remote code execution (RCE).

Recommendations For Listingo WordPress theme versions prior to 3.2.7, update to version 3.2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX upload action to authenticated users only.

Exploit

Fix

Related Identifiers

CVE-2022-3921

Affected Products

Listingo

References · 4

• 🔥 https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3921 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3921 · Vendor Advisory
• https://t.me/cvenotify/39658 · Telegram Post