CVE-2022-2433

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-2433
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2433.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-2433
Published
2022-09-06T18:15:13.590Z
Modified
2026-03-15T22:45:56.347650Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'almrepeatersexport' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

References

Affected packages

Git / github.com/ajaxloadmore/ajax-load-more

Affected ranges

Type
GIT
Repo
https://github.com/ajaxloadmore/ajax-load-more
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b577b3257544bc74a5d2ad14f0a0f7df3eb843de

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2433.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "5.5.4"
            }
        ]
    }
]