CVE-2022-3881

MEDIUM

WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascri...

Title source: llm
STIX 2.1

Description

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/c2a9cf01-051a-429a-82ca-280885114b5a

Scores

CVSS v3 5.7
EPSS 0.0044
EPSS Percentile 35.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352 CWE-863
Status published
Products (1)
wptools_project/wptools < 3.43
Published Dec 12, 2022
Tracked Since Feb 18, 2026