CVE-2022-34487

CRITICALNuclei

WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-34487 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 30, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 20, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Shortcode Addons (WordPress plugin)

Browse biplob018 / Shortcode Addons (WordPress plugin)
CVE List<= 3.0.2 to ≤ 3.0.2affected

Shortcode Addons Plugin

Browse oxilab / Shortcode Addons Plugin
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALShortCode Addons - Unauthenticated Options UpdateCVSS 9.8

WordPress plugin Shortcode Addons <= 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication.

Impact

Attackers can modify plugin options arbitrarily, potentially leading to site defacement, data tampering, or further exploitation.

Remediation

Update to the latest version of Shortcode Addons plugin.

WeaknessesCWE-264
AuthorsSourabh-Sahu
Template tagscvecve2022wpwp-pluginwordpressshortcode-addonsvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:oxilab:shortcode_addons:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/c8dd91d5-fdc4-4852-9823-6d0047b214fe/ https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-0-3-unauthenticated-arbitrary-option-update-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2022-34487

Source: ProjectDiscovery

References

3