VulnerabilityModified

CVE-2022-4950

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

HIGH 8.8EPSS 1.37%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.37% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: coolplugins/cool timeline · coolplugins/cryptocurrency widgets · coolplugins/cryptocurrency widgets for elementor · coolplugins/event single page builder for the event calendar · coolplugins/events-notification-bar-addon · coolplugins/events search for the events calendar · coolplugins/events shortcodes for the events calendar · coolplugins/events widgets for elementor and the events calendar · coolplugins/the events calendar countdown addon · cryptocurrency payment \& donation box plugins/cryptocurrency payment \& donation box
Source: security@wordfence.com

References

https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.phpPatch
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cveBroken Link, Third Party Advisory
https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.phpPatch
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cveBroken Link, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.