CVE-2022-3679: Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection
The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3679?
CVE-2022-3679 refers to a vulnerability in the Starter Templates by Kadence WP WordPress plugin before version 1.2.17, which allows for PHP object injection issues when an admin imports a malicious file with a suitable gadget chain.
How does CVE-2022-3679 impact users?
CVE-2022-3679 can potentially allow an attacker to execute arbitrary PHP code on a vulnerable WordPress site by importing a malicious file.
What is the severity of CVE-2022-3679?
CVE-2022-3679 has a severity rating of 8.8, which is considered high.
How do I check if my site is affected by CVE-2022-3679?
To check if your site is affected by CVE-2022-3679, you can use a vulnerability scanner or check if you are using the vulnerable version of the Starter Templates by Kadence WP plugin (version prior to 1.2.17).
How do I fix CVE-2022-3679?
To fix CVE-2022-3679, it is recommended to update the Starter Templates by Kadence WP plugin to version 1.2.17 or later, which resolves the vulnerability.