CVE-2022-3401: Code Injection
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3401?
CVE-2022-3401 is considered a critical vulnerability that allows for remote code execution.
How do I fix CVE-2022-3401?
To fix CVE-2022-3401, upgrade the Bricks theme to version 1.5.4 or later.
Who is affected by CVE-2022-3401?
CVE-2022-3401 affects users of the Bricks theme for WordPress versions 1.2 to 1.5.3.
What can an attacker do with CVE-2022-3401?
An attacker can execute arbitrary code on the site, potentially compromising its security and integrity.
Is CVE-2022-3401 linked to any other vulnerabilities?
Yes, CVE-2022-3401 is associated with CVE-2022-3400, which involves missing authorization issues.