PT-2024-11529 · WordPress · Theme Editor

Rasoul Jahanshahi

·

Published

2024-08-28

·

Updated

2024-09-02

·

CVE-2022-2440

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Theme Editor plugin for WordPress versions up to, and including 2.8
Description The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the images array parameter. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects, which can be used to perform a variety of malicious actions if a POP chain is also present. The attack requires the attacker to be successful in uploading a file with the serialized payload.
Recommendations For versions up to, and including 2.8, consider disabling the images array parameter until a patch is available to prevent deserialization of untrusted input. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the images array parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-2440

Affected Products

Theme Editor