CVE-2022-3883: StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-12 · updated 2026-06-17
Weakness: CWE-352

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Affected products

Stopbadbots Project Stopbadbots: before 7.24 — fixed in 7.24

How to fix

Upgrade to a fixed version: Stopbadbots Project Stopbadbots 7.24. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544
https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544

Get alerted when CVE-2022-3883 or the next vulnerability affects your stack