Log in Start free

Vulnerability · Published Oct 16, 2024 · Assigned by Wordfence

CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks

Medium 6.3

In plain English

A medium-severity missing authorization in DancePress (TRWA) from benmoreassynt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 61.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Affected products (as reported)

VendorProductVersions
dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress 0 – before 2.0.2
nicheaddons Events Addon for Elementor 0 – before 1.9.8
dots Fraud Prevention For WooCommerce and EDD 0 – before 2.1.0
wpengine Gutenberg Blocks – ACF Blocks Suite 0 – before 2.6.8
bouncingsprout Ultimeter 0 – before 2.7.6
toddhalfpenny Past Events Extension 0
pootlepress Pootle Pagebuilder – WordPress Page builder 0 – before 5.7.1
powerfulwp Local Delivery Drivers for WooCommerce 0 – before 1.8.5
kkikuchi1220 Ultimate Gutenberg – Custom Block Templates 0
josevega WP Required Taxonomies – Categories and Tags Mandatory 0 – before 1.1.8
pmbaldha Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin) 0
sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects 0 – through 4.0.4
wisersteps Streak CRM For Gmail For Contact Form 7 – WordPress Plugin 0 – before 1.0.9
wpdevpowers WordPress Dev Powers – ACF Color Coded Field Types Plugin 0
benmoreassynt DancePress (TRWA) 0 – through 3.1.2
dots Product Size Charts Plugin for WooCommerce 0 – before 2.2.3
tribalnerd Wp My Admin Bar 0
setka A no-code page builder for beautiful performance-based content 0 – before 2.1.17
mikebels LocalSEOMap 0
cromer12 Easy Prayer 0
rafalosinski AdFoxly – Ad Manager, AdSense Ads & Ads.txt 0 – through 1.8.4
stevehenty WP Get Personal 0
theafricanboss/ Checkout with Cash App on EDD 0
usmanaliqureshi Server Info 0
themelocation Custom WooCommerce Checkout Fields Editor 0 – through 1.2.6
krsp KRSP Frontend File Uploader 0
bplugins Panorama – 360 Virtual Tour, Panoramic image viewer and More 0 – before 1.0.8
janwyl Bulk Attachment Download 0 – before 1.3.5
majick AutoSave Net 0
premmerce Premmerce Wholesale Pricing for WooCommerce 0 – before 1.1.8

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References