CVE-2022-4950CWE-862

Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation

High · published June 7, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
71.6
In the wild
Unconfirmed
What it is

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01366 · 71.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-06-07T01:51Z
EPSS history
Timeline
  • 07 JUN 01:51Z
    Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation
    cvelistv5