What’s Vulnerable › Vulnerabilities

CVE-2022-3425: Google Analyticator < 6.5.6 - Admin+ PHP Object Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-23 · updated 2026-06-17

Description

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

Affected products

• Analyticator: before 6.5.6 — fixed in 6.5.6

How to fix

Upgrade to a fixed version: Analyticator 6.5.6. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/df1c36bb-9861-4272-89c9-ae76e62f687c
• https://wpscan.com/vulnerability/df1c36bb-9861-4272-89c9-ae76e62f687c

Get alerted when CVE-2022-3425 or the next vulnerability affects your stack