6.3
Medium
CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
Description
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| YASR – Yet Another Star Rating Plugin for WordPress 2.0 | earliest → < 2.0.2 | 2.0.2 |
| Events Addon for Elementor 1.9 | earliest → < 1.9.8 | 1.9.8 |
| Fraud Prevention For WooCommerce and EDD 2.1 | earliest → < 2.1.0 | 2.1.0 |
| Gutenberg Blocks – ACF Blocks Suite 2.6 | earliest → < 2.6.8 | 2.6.8 |
| Ultimeter 2.7 | earliest → < 2.7.6 | 2.7.6 |
| Past Events Extension | 0 | No fix stated |
| Pootle Pagebuilder – WordPress Page builder 5.7 | earliest → < 5.7.1 | 5.7.1 |
| Local Delivery Drivers for WooCommerce 1.8 | earliest → < 1.8.5 | 1.8.5 |
| Ultimate Gutenberg – Custom Block Templates | 0 | No fix stated |
Show the 751 other branches Hide the 751 other branches
References
- www.wordfence.com www.wordfence.com
- wpscan.com wpscan.com
- freemius.com freemius.com
- wpdirectory.net wpdirectory.net
- wpdirectory.net wpdirectory.net
- web.archive.org web.archive.org
Timeline
- Published
- Last modified