CVE-2022-4950
First published: Wed Jun 07 2023(Updated: )
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Coolplugins Cool Timeline | <2.4 | |
| Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List | <2.5.1 | |
| Cool Plugins Cryptocurrency Widgets For Elementor | <1.3 | |
| Coolplugins Event Single Page Builder For The Event Calendar | <1.6 | |
| Coolplugins Events Notification Bar Addon | <1.6 | |
| Coolplugins Events Search For The Events Calendar | <1.2 | |
| Coolplugins Events Shortcodes For The Events Calendar | <2.0 | |
| Coolplugins Events Widgets For Elementor And The Events Calendar | <1.5 | |
| Coolplugins The Events Calendar Countdown Addon | <1.4 | |
| Cryptocurrency Payment & Donation Box | <1.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/
- https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve
Frequently Asked Questions
What is CVE-2022-4950?
CVE-2022-4950 refers to a vulnerability found in several WordPress plugins developed by Cool Plugins that allows for arbitrary plugin installation and activation, leading to remote code execution by authenticated attackers with minimal permissions.
Which WordPress plugins by Cool Plugins are affected by CVE-2022-4950?
The following WordPress plugins developed by Cool Plugins are affected by CVE-2022-4950: Cool Timeline (up to version 2.4), Cryptocurrency Widgets (up to version 2.5.1), Cryptocurrency Widgets For Elementor (up to version 1.3), Event Single Page Builder For The Event Calendar (up to version 1.6), Events-notification-bar-addon (up to version 1.6), Events Search For The Events Calendar (up to version 1.2), Events Shortcodes For The Events Calendar (up to version 2.0), Events Widgets For Elementor And The Events Calendar (up to version 1.5), and The Events Calendar Countdown Addon (up to version 1.4).
What is the severity of CVE-2022-4950?
CVE-2022-4950 has a severity rating of 8.8, which is considered high.
How can an attacker exploit CVE-2022-4950?
Authenticated attackers with minimal permissions, such as a subscriber, can exploit CVE-2022-4950 to perform arbitrary plugin installation and activation, leading to remote code execution.
Are there any resources available for more information on CVE-2022-4950?
Yes, you can find more information on CVE-2022-4950 at the following resources: [Link 1](https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/), [Link 2](https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php), and [Link 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve).
- agent/references
- agent/weakness
- agent/author
- agent/remedy
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/coolplugins
- canonical/coolplugins cool timeline
- canonical/cool plugins cryptocurrency widgets – price ticker & coins list
- canonical/cool plugins cryptocurrency widgets for elementor
- canonical/coolplugins event single page builder for the event calendar
- canonical/coolplugins events notification bar addon
- canonical/coolplugins events search for the events calendar
- canonical/coolplugins events shortcodes for the events calendar
- canonical/coolplugins events widgets for elementor and the events calendar
- canonical/coolplugins the events calendar countdown addon
- vendor/cryptocurrency payment \& donation box plugins
- canonical/cryptocurrency payment & donation box