CVE-2022-1749

ALTO 8.8CVE-2022-1749 · Published 13/06/2022 · updated 17/06/2026

In breve

CVE-2022-1749 è una vulnerabilità ALTO (CVSS 8.8) che riguarda wpmk ajax finder (wpmk ajax finder project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.80%, superiore al 56.9% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
wpmk ajax finder wpmk_ajax_finder_project	`≤ 1.0.1`	No fix yet

Description

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.

References

plugins.trac.wordpress.org/browser/find-any-think/trunk/inc/config/create-plugin-admin.php · Exploit
wordfence.com/threat-intel/vulnerabilities/id/1d063d01-5f67-4c7f-ab71-01708456e82b · Third Party Advisory
wordfence.com/vulnerability-advisories · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free