CVE-2022-4949

ÉLEVÉE 8.8CVE-2022-4949 · Published 07/06/2023 · updated 17/06/2026

En bref

CVE-2022-4949 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant adsanity (adsanityplugin).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.2%, plus élevée que 82.4% des vulnérabilités.
Correctif : mettre à jour vers 1.8.2 ou plus récent.

Package	Affected versions	Patched versions
adsanity adsanityplugin	`< 1.8.2`	`1.8.2`

Description

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible.

References

blog.nintechnet.com/critical-vulnerability-in-wordpress-adsanity-plugin · Exploit
wordfence.com/threat-intel/vulnerabilities/id/effd72d2-876d-4f8d-b1e4-5ab38eab401b · Third Party Advisory
openwall.com/lists/oss-security/2023/11/09/3 · Mailing List
xenbits.xen.org/xsa/advisory-443.html · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free