Vulnerability in WP Editor Plugin Allows Deserialization of Untrusted Input

CVE-2022-2446

What is CVE-2022-2446?

The WP Editor plugin for WordPress has a vulnerability that exposes it to deserialization of untrusted input through the 'current_theme_root' parameter in versions up to and including 1.2.9. This vulnerability enables authenticated attackers with administrative privileges to upload a file containing a serialized payload. Once successful, they can leverage a PHAR wrapper to deserialize and execute arbitrary PHP objects, potentially leading to a variety of malicious actions. It is critical for users to ensure they are using an updated version of the plugin to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References