CVE-2022-4950: Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-4950?
CVE-2022-4950 refers to a vulnerability found in several WordPress plugins developed by Cool Plugins that allows for arbitrary plugin installation and activation, leading to remote code execution by authenticated attackers with minimal permissions.
Which WordPress plugins by Cool Plugins are affected by CVE-2022-4950?
The following WordPress plugins developed by Cool Plugins are affected by CVE-2022-4950: Cool Timeline (up to version 2.4), Cryptocurrency Widgets (up to version 2.5.1), Cryptocurrency Widgets For Elementor (up to version 1.3), Event Single Page Builder For The Event Calendar (up to version 1.6), Events-notification-bar-addon (up to version 1.6), Events Search For The Events Calendar (up to version 1.2), Events Shortcodes For The Events Calendar (up to version 2.0), Events Widgets For Elementor And The Events Calendar (up to version 1.5), and The Events Calendar Countdown Addon (up to version 1.4).
What is the severity of CVE-2022-4950?
CVE-2022-4950 has a severity rating of 8.8, which is considered high.
How can an attacker exploit CVE-2022-4950?
Authenticated attackers with minimal permissions, such as a subscriber, can exploit CVE-2022-4950 to perform arbitrary plugin installation and activation, leading to remote code execution.
Are there any resources available for more information on CVE-2022-4950?
Yes, you can find more information on CVE-2022-4950 at the following resources: [Link 1](https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/), [Link 2](https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php), and [Link 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve).