by Kastro
Paper/Archive/CVE-2022-4120

CVE-2022-4120

Unknown Stop Spammers Security | Block Spam Users, Comments, Forms — Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection

EPSS 18%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.2.972 × 2019.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain

Affected

ProductAffectedFixed inSource
Stop Spammers Security | Block Spam Users, Comments, Forms< 2022.62022.6CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf