9.8
Critical
CVE-2022-3900 The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before…
Description
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cooked Pro 1.7 | earliest → < 1.7.5.7 | 1.7.5.7 |