CVE-2022-4974: Freemius SDK <= 2.4.2 - Missing Authorization Checks

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-16 · updated 2026-06-17
Weakness: CWE-862

Description

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Affected products

5starplugins Easy Age Verify: before 1.6.1 — fixed in 1.6.1
5starplugins Featured Images in RSS for Mailchimp & More: before 1.5.9 — fixed in 1.5.9
5starplugins Marijuana Age Verify: before 1.3.1 — fixed in 1.3.1
9brada6 Tabs with Recommended Posts (Widget): 0
actuaryzask azw woocommerce file uploads: 0
nasirahmed AFI – The Easiest Integration Plugin: before 1.49.0 — fixed in 1.49.0
nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook: before 1.1.9 — fixed in 1.1.9
pagup WP Google Street View (with 360° virtual tour) & Google maps + Local SEO: before 1.0.9 — fixed in 1.0.9
aguilerasoft Conversion de moneda Woocommerce: 0
aharonyan Guest posting / Frontend Posting / Front Editor – WP Front User Submit: before 3.4.1 — fixed in 3.4.1
ahmed17 CF7 Constant Contact Fields Mapping: 0
ahmed17 Menu Item Scheduler: 0
ahmed17 RW Divi Unite Gallery: through 1.0
akdevs Genealogical Tree – Family Tree & Ancestry for WordPress: through 2.1.5
alekv Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: before 1.14.3 — fixed in 1.14.3
alex-ye bbResolutions: 0
alleythemes Alley Business Toolkit: before 1.1.8 — fixed in 1.1.8
alphabposervice Easy Code Snippets: before 1.0.1 — fixed in 1.0.1
alphabposervice Easy Math Captcha for CF7: 0
alphabposervice Easy Newsletter Signups: before 1.0.4 — fixed in 1.0.4
alphabposervice Easy Post Views Count: before 1.0.5 — fixed in 1.0.5
hiddenpearls Custom Login Page Customizer: before 2.1.8 — fixed in 2.1.8
hiddenpearls WordPress Reviews by ReviewPress: 0
anasbinmukim MailChimp Manager: 0
andyabelow Media Library File Download: before 1.1 — fixed in 1.1
Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung: 0
ankitmaru Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: before 6.0.0 — fixed in 6.0.0
annastaa annasta Filters for WooCommerce: before 1.5.0 — fixed in 1.5.0
anssilaitila Contact List – Online Staff Directory & Address Book: before 2.9.50 — fixed in 2.9.50
anssilaitila Shared Files – Frontend File Upload Form & Secure File Sharing: before 1.6.72 — fixed in 1.6.72

How to fix

Upgrade to a fixed version: 5starplugins Easy Age Verify 1.6.1; 5starplugins Featured Images in RSS for Mailchimp & More 1.5.9; 5starplugins Marijuana Age Verify 1.3.1; nasirahmed AFI – The Easiest Integration Plugin 1.49.0; nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook 1.1.9; pagup WP Google Street View (with 360° virtual tour) & Google maps + Local SEO 1.0.9; aharonyan Guest posting / Frontend Posting / Front Editor – WP Front User Submit 3.4.1; alekv Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing 1.14.3; alleythemes Alley Business Toolkit 1.1.8; alphabposervice Easy Code Snippets 1.0.1; alphabposervice Easy Newsletter Signups 1.0.4; alphabposervice Easy Post Views Count 1.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-4974 or the next vulnerability affects your stack