VULNERABILITY INTELLIGENCE

CVE-2022-0499

CVSS score8.8 HIGH
EPSS probability0.63%
CISA KEVNot currently listed
Published2022-03-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references