CVE-2022-3335CWE-502

Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection

High · published October 25, 2022

CVSS v3.1
7.2
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01517 · 74.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2022-10-25T00:00Z
EPSS history
Timeline
  • 25 OCT 00:00Z
    Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection
    cvelistv5