CVE-2022-4120
Critical
Description
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
SeverityCritical
CVSS9.8
Exploit probability—
ProductTrumani Stop Spammers
PublishedDec 26, 2022
First seenDec 26, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- trumani stop_spammers2022.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trumani stop_spammers | v < 2022.6 | 2022.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.