CVE-2022-3335 Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection

2022-10-2500:00:00

CWE-502

WPScan

www.cve.org

kadence woocommerce email designer

php object injection

wordpress plugin

admin

unserialises

malicious file

gadget chain

EPSS

0.001

Percentile

42.9%

JSON

The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Kadence WooCommerce Email Designer",
    "versions": [
      {
        "version": "1.5.7",
        "status": "affected",
        "lessThan": "1.5.7",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/39514705-c887-4a02-a77b-36e1dcca8f5d

EPSS

0.001

Percentile

42.9%

JSON

Related for CVELIST:CVE-2022-3335