CVE-2022-2437 Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization
CriticalCVSS 9.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| slickremix Feed Them Social – Social Media Feeds, Video, and Photo Galleries | <= 2.9.8.5 | No fix listed |
| wordpress feed-them-social(WordPress) | < 2.9.8.6 | 2.9.8.6 |
| slickremix Feed Them Social | < 2.9.8.6 | 2.9.8.6 |
References
- www.wordfence.com third-party-advisory
- plugins.trac.wordpress.org patch
- www.wordfence.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org