CVE-2022-3900 Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
Unauthenticated attackers can trigger PHP object injection via the recipe_args parameter, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3900?
CVE-2022-3900 is a critical unsafe deserialization vulnerability in Unknown Cooked Pro, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
Which versions are affected by CVE-2022-3900?
It affects 1 product.
Products include Boxystudio Cooked.
How do I fix CVE-2022-3900?
No fix has been published for CVE-2022-3900 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-3900 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3900 exists.
Other vulnerabilities in Unknown Cooked Pro
- CVE-2023-44477 WordPress Cooked Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-39682 WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt
- CVE-2021-24233 Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)
- CVE-2024-41816 WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode
- CVE-2024-39680 WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save
Sources
Also known as GHSA-gx5q-2vpf-g2w4.