CVE-2022-3334 - Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection

Back Back to CVE browser

HIGH

Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection

Published Oct 31, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.24%

Description

The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Affected products

Vendor n/a Product Easy WP SMTP Default
unknown
Affected
- ≥ 1.5.0, < 1.5.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Easy WP SMTP	unknown	Affected ≥ 1.5.0, < 1.5.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42721
Advisory
https://wpscan.com/vulnerability/0e735502-eaa2-4047-949e-bc8eb6b39fc9
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42721		Advisory
https://wpscan.com/vulnerability/0e735502-eaa2-4047-949e-bc8eb6b39fc9		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Oct 31, 2022

Updated May 6, 2025

Reserved Sep 27, 2022

Link CVE-2022-3334

CISA Vulnrichment

Updated May 6, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-3334

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Oct 31, 2022

Updated May 6, 2025

Link EUVD-2022-42721

GitHub

No data