What is the severity of CVE-2022-3881?

The severity of CVE-2022-3881 is considered to be medium due to the potential impact of unauthorized access by authenticated users.

How do I fix CVE-2022-3881?

To fix CVE-2022-3881, update the WP Tools plugin to version 3.43 or later.

Who is affected by CVE-2022-3881?

CVE-2022-3881 affects any authenticated users, including subscribers, on WordPress sites utilizing vulnerable versions of the WP Tools plugin.

What types of attacks can be performed due to CVE-2022-3881?

CVE-2022-3881 can allow attackers to execute unauthorized AJAX actions, leading to potential data exposure and manipulation.

Is CVE-2022-3881 a zero-day vulnerability?

No, CVE-2022-3881 is not classified as a zero-day vulnerability since it has been publicly disclosed and a fix is available.

Vulnerability/
CVE-2022-3881

medium

5.7

CWE

352 863

12/12/2022

3/8/2024

CVE-2022-3881: WPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation

First published: Mon Dec 12 2022(Updated: )

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Credit: contact@wpscan.com

Affected Software	Affected Version	How to fix
Array-tools	<3.43

Never miss a vulnerability like this again

Reference Links

https://wpscan.com/vulnerability/c2a9cf01-051a-429a-82ca-280885114b5a

Frequently Asked Questions

What is the severity of CVE-2022-3881?
The severity of CVE-2022-3881 is considered to be medium due to the potential impact of unauthorized access by authenticated users.
How do I fix CVE-2022-3881?
To fix CVE-2022-3881, update the WP Tools plugin to version 3.43 or later.
Who is affected by CVE-2022-3881?
CVE-2022-3881 affects any authenticated users, including subscribers, on WordPress sites utilizing vulnerable versions of the WP Tools plugin.
What types of attacks can be performed due to CVE-2022-3881?
CVE-2022-3881 can allow attackers to execute unauthorized AJAX actions, leading to potential data exposure and manipulation.
Is CVE-2022-3881 a zero-day vulnerability?
No, CVE-2022-3881 is not classified as a zero-day vulnerability since it has been publicly disclosed and a fix is available.

agent/type
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/references
agent/author
agent/title
agent/severity
agent/weakness
agent/event
agent/first-publish-date
agent/description
agent/softwarecombine
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/wptools project
canonical/array-tools

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2022-3881?
The severity of CVE-2022-3881 is considered to be medium due to the potential impact of unauthorized access by authenticated users.
How do I fix CVE-2022-3881?
To fix CVE-2022-3881, update the WP Tools plugin to version 3.43 or later.
Who is affected by CVE-2022-3881?
CVE-2022-3881 affects any authenticated users, including subscribers, on WordPress sites utilizing vulnerable versions of the WP Tools plugin.
What types of attacks can be performed due to CVE-2022-3881?
CVE-2022-3881 can allow attackers to execute unauthorized AJAX actions, leading to potential data exposure and manipulation.
Is CVE-2022-3881 a zero-day vulnerability?
No, CVE-2022-3881 is not classified as a zero-day vulnerability since it has been publicly disclosed and a fix is available.