What’s Vulnerable › Vulnerabilities

CVE-2022-3679: Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-09 · updated 2026-06-17

Description

The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Affected products

• Starter Templates by Kadence WP: through 1.2.17

References

• https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760
• https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760

Get alerted when CVE-2022-3679 or the next vulnerability affects your stack