CVE-2022-3335 Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection

2022-10-2500:00:00

CWE-502

WPScan

www.cve.org

kadence woocommerce email designer

php object injection

wordpress plugin

admin

unserialises

malicious file

gadget chain

0.001 Low

EPSS

Percentile

43.1%

JSON

The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Kadence WooCommerce Email Designer",
    "versions": [
      {
        "version": "1.5.7",
        "status": "affected",
        "lessThan": "1.5.7",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/39514705-c887-4a02-a77b-36e1dcca8f5d

0.001 Low

EPSS

Percentile

43.1%

JSON

Related for CVELIST:CVE-2022-3335