CVE-2022-2434 String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization

🗓️ 06 Sep 2022 17:18:57Reported by WordfenceType

The WordPress String Locator plugin (up to version 2.5.0) allows unauthenticated users to perform malicious actions by deserializing untrusted input in the 'string-locator-path' parameter, granted they can trick a site administrator into performing a specific action that enables calling arbitrary PHP Objects using a PHAR wrapper and a successful file upload with a serialized payload

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-2434	6 Sep 202218:15	–	attackerkb
CNNVD	WordPress plugin String Locator 代码问题漏洞	6 Sep 202200:00	–	cnnvd
CVE	CVE-2022-2434	6 Sep 202217:18	–	cve
EUVD	EUVD-2022-34695	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2434	6 Sep 202218:15	–	nvd
OpenVAS	WordPress String Locator Plugin <= 2.5.0 Deserialization of Untrusted Data Vulnerability	4 Oct 202200:00	–	openvas
OSV	CVE-2022-2434	6 Sep 202218:15	–	osv
Patchstack	WordPress String Locator plugin <= 2.5.0 - Authenticated PHAR Deserialization vulnerability	8 Aug 202200:00	–	patchstack
Prion	Deserialization of untrusted data	6 Sep 202218:15	–	prion
Positive Technologies	PT-2022-16623	6 Sep 202200:00	–	ptsecurity

[
  {
    "vendor": "instawp",
    "product": "String locator",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/10a36e37-4188-403f-9b17-d7e79b8b8a6d
wordfence	www.wordfence.com/vulnerability-advisories/
plugins	www.plugins.trac.wordpress.org/browser/string-locator/trunk/editor.php

08 Apr 2026 16:36Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

EPSS0.05157

CWE-502