PT-2023-12626 · WordPress · Club-Theme+9

Joshua Small · Published 2023-01-23 · Updated 2023-01-31 · CVE-2022-0316

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeStand WordPress theme versions prior to 2.1 footysquare WordPress theme aidreform WordPress theme statfort WordPress theme club-theme WordPress theme kingclub-theme WordPress theme spikes WordPress theme spikes-black WordPress theme soundblast WordPress theme bolster WordPress theme

Description The issue concerns a lack of authorization and upload validation in the lang upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server. This enables potential malicious activities without proper access controls.

Recommendations For WeStand WordPress theme version prior to 2.1, update to version 2.1 or later. For footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, and bolster WordPress theme, consider disabling the lang upload.php file until a patch is available to prevent unauthorized file uploads.

Exploit

Fix

Related Identifiers

CVE-2022-0316

Affected Products

Westand

Aidreform

Bolster

Club-Theme

Footysquare

Kingclub-Theme

Soundblast

Spikes

Spikes-Black

Statfort

References · 6

• 🔥 https://github.com/KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit · Exploit
• 🔥 https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c · Exploit
• https://osv.dev/vulnerability/CVE-2022-0316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0316 · Security Note
• https://t.me/cibsecurity/56851 · Telegram Post
• https://t.me/cvenotify/43216 · Telegram Post