CVE-2022-1749

HOCH 8.8CVE-2022-1749 · Published 13/06/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-1749 ist eine Schwachstelle (HOCH (CVSS 8.8)) in wpmk ajax finder (wpmk ajax finder project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.80%, höher als bei 56.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
wpmk ajax finder wpmk_ajax_finder_project	`≤ 1.0.1`	No fix yet

Description

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.

References

plugins.trac.wordpress.org/browser/find-any-think/trunk/inc/config/create-plugin-admin.php · Exploit
wordfence.com/threat-intel/vulnerabilities/id/1d063d01-5f67-4c7f-ab71-01708456e82b · Third Party Advisory
wordfence.com/vulnerability-advisories · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free