Vulnerability in WP Editor Plugin Allows Deserialization of Untrusted Input

CVE-2022-2446

Summary

The WP Editor plugin for WordPress has a vulnerability that exposes it to deserialization of untrusted input through the 'current_theme_root' parameter in versions up to and including 1.2.9. This vulnerability enables authenticated attackers with administrative privileges to upload a file containing a serialized payload. Once successful, they can leverage a PHAR wrapper to deserialize and execute arbitrary PHP objects, potentially leading to a variety of malicious actions. It is critical for users to ensure they are using an updated version of the plugin to mitigate these risks.

References