CVE-2022-2440: high-severity vulnerability in mndpsingh287 Theme Editor
Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.7%
The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
mndpsingh287 · Theme EditorRelated CVEs — mndpsingh287 Theme Editor
In the same product, most dangerous first.
CVE-2023-6091HIGHWordPress Theme Editor plugin <= 2.7.1 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2025-9890HIGHTheme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code ExecutionEPSS 0.4%CVE-2025-14469MEDIUMTheme Editor <= 3.1 - Cross-Site Request Forgery to CSS ModificationEPSS 0.2%CVE-2026-39640CRITICALWordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerabilityEPSS 0.1%