CVE-2022-4120
9.8
CRITICAL · CVSS 3.1 · EPSS 18.1% (pctl 97)
Patch early
EPSS 18.1% — above the 10% action threshold.
Description
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 18.12% — more likely to be exploited than 97% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-12-26 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| trumani | stop spammers |
References
→ the Explorer · watch your stack · NVD