CVE-2022-3417

WPtouch < 4.3.45 - Admin+ PHP Object Injection

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.

Affected

WPtouch

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.92% chance of exploitation in the next 30 days, 60th percentile

Published

2023-01-09

Updated

2025-04-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/55772932-eebd-475b-b5df-e80fab288ee5

References

• CVE Record
• NVD entry