CVE-2022-3881 WPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation
Authenticated subscribers can install arbitrary plugins due to missing authorization and CSRF checks, leading to potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3881?
CVE-2022-3881 is a medium-severity missing authorization vulnerability in Unknown WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log, published on 12 Dec 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Which versions are affected by CVE-2022-3881?
It affects 1 product.
Products include Wptools Project Wptools.
How do I fix CVE-2022-3881?
No fix has been published for CVE-2022-3881 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-3881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3881 exists.
Sources
Also known as GHSA-pf3w-64p8-hrfr.