CVE-2022-3417

CVE-2022-3417: WPtouch < 4.3.45 - Admin+ PHP Object Injection

Vendor Unknown
Product WPtouch
Published January 9, 2023
Last update April 9, 2025

CVSS base score

What the vulnerability does

01Description

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.

Key dates

02Disclosure timeline

January 9, 2023 CVE published
April 9, 2025 Record updated