CVE-2022-3879

MEDIUM

Car Dealer WordPress Plugin < 3.05 - Authenticated Arbitrary Plugin Installation via AJAX Action

Title source: llm

Description

The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/0db1762e-1401-4006-88ed-d09a4bc6585b

Scores

CVSS v3 6.5

EPSS 0.0034

EPSS Percentile 25.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352 CWE-863

Status published

Products (1)

car_dealer_project/car_dealer < 3.05

Published Dec 12, 2022

Tracked Since Feb 18, 2026