High severity · published Dec 7, 2022
CVE-2022-43468
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted…
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WordPress Popular Posts · Hector Cabrera
6.0.5 and earlier · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43468
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43468
Third Party Advisory
https://github.com/cabrerahector/wordpress-popular-posts/
Third Party Advisory
https://jvn.jp/en/jp/JVN13927745/index.html
Product
https://wordpress.org/plugins/wordpress-popular-posts/
More from WordPress Popular Posts
5.4
CVE-2023-45607
WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)