CVE-2022-1609

2024-01-1616:15:09

CWE-94

WPScan

web.nvd.nist.gov

1816

In Wild

cve-2022-1609

wordpress plugin

backdoor

unauthenticated attack

arbitrary php code

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.389

Percentile

97.3%

JSON

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it’s license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.

Affected configurations

Nvd

Vulners

Node

weblizarschool_managementRange<9.9.7prowordpress

VendorProductVersionCPE
weblizarschool_management*cpe:2.3:a:weblizar:school_management:*:*:*:*:pro:wordpress:*:*

Vendor	Product	Version	CPE
weblizar	school_management	*	cpe:2.3:a:weblizar:school_management:::::pro:wordpress::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "school-management-pro",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "9.9.7"
      }
    ],
    "defaultStatus": "unaffected"
  }
]