CVE-2022-34487 WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability

Q: What is CVE-2022-34487?

CVE-2022-34487 is a critical missing authorization vulnerability in biplob018 Shortcode Addons (WordPress plugin), published on 21 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2022-34487 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-34487 exists.

Q: How do I fix CVE-2022-34487?

No fix has been published for CVE-2022-34487 yet. Limit exposure of the affected software until one is available.

Critical 9.8 Published 21 Jul 2022 Updated 28 Apr 2026

Unauthenticated attackers can arbitrarily update WordPress options via the Shortcode Addons plugin, potentially compromising site integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-34487?

CVE-2022-34487 is a critical missing authorization vulnerability in biplob018 Shortcode Addons (WordPress plugin), published on 21 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

Weakness: CWE-264

Which versions are affected by CVE-2022-34487?

It affects 1 product.

Products include Oxilab Shortcode Addons.

How do I fix CVE-2022-34487?

No fix has been published for CVE-2022-34487 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-34487 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-34487 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-2pxw-qgwm-32jg.