CVE-2022-2180

The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.52% chance of exploitation in the next 30 days, 84th percentile

Published

2022-08-15

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1

References

• CVE Record
• NVD entry

Related

• CVE-2022-21797
• CVE-2022-21803
• CVE-2022-21789
• CVE-2022-21806
• CVE-2022-2175
• CVE-2022-21809