PT-2022-25289 · WordPress · Xplodedthemes Wpide

Re-Alter + 1 · Published 2022-09-21 · Updated 2022-09-23 · CVE-2022-40217

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XplodedThemes WPide plugin versions <= 2.6

Description The issue is an Authenticated Arbitrary File Edit/Upload vulnerability. This means that an attacker with admin or higher privileges can edit or upload files arbitrarily in the XplodedThemes WPide plugin at WordPress.

Recommendations For XplodedThemes WPide plugin versions <= 2.6, update to a version higher than 2.6 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-40217

Affected Products

Xplodedthemes Wpide

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-40217 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40217 · Vendor Advisory
• https://t.me/cibsecurity/50246 · Telegram Post
• https://wordpress.org/plugins/wpide/#developers · Note
• https://patchstack.com/database/vulnerability/wpide/wordpress-wpide-plugin-2-6-authenticated-arbitrary-file-edit-upload-vulnerability · Note