CVE-2022-4120critical

CVE-2022-4120: critical vulnerability in Stop Spammers Security | Block Spam Users…

Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection

Published · Updated

Follow this CVE+ Monitor Stop Spammers Security | Block Spam Users, Comments, Forms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

53Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 18%
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Stop Spammers Security | Block Spam Users, Comments, Forms
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Stop Spammers Security | Block Spam Users…

In the same product, most dangerous first.

CVE-2021-24517—Stop Spammers Security < 2021.18 - Authenticated Stored XSSEPSS 0.6%CVE-2023-2488MEDIUMStop Spammers Security < 2023 - Reflected XSSEPSS 0.5%CVE-2023-2489MEDIUMStop Spammers Security < 2023 - Admin+ Stored XSSEPSS 0.4%