CVE-2022-3882

MEDIUM

wp-memory < 2.46 - Authenticated Arbitrary Plugin Installation via CSRF

Title source: llm

Description

The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/a39c643f-eaa4-4c71-b75d-2c4fe34ac875

Scores

CVSS v3 6.5

EPSS 0.0033

EPSS Percentile 24.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352 CWE-863

Status published

Products (1)

wp-memory_project/wp-memory < 2.46

Published Dec 12, 2022

Tracked Since Feb 18, 2026