IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
6.3Medium

CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks

dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress; nicheaddons Events Addon for Elementor; dots Fraud Prevention For WooCommerce and EDD; wpengin… Published: (2 years ago)

Description

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Weakness (CWE): CWE-862

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
ahmed17 CF7 Constant Contact Fields Mapping 0
badhonrocks Styler Mate for Contact Form 7 < 1.3.0
benmoreassynt DancePress (TRWA) ≤ 3.1.2
bouncingsprout Ultimeter < 2.7.6
bplugins Panorama – 360 Virtual Tour, Panoramic image viewer and More < 1.0.8
bplugins Super Video player – Fully Customizable Video Player with Playlist < 1.6.11
bplugins YT Player – Embed and Customize Video Players < 1.5.1
clickervolt ClickerVolt – Affiliate Links & Click Tracking for Performance Marketers 0
cromer12 Easy Prayer 0
daigo75 EU VAT Assistant for WooCommerce < 2.0.28.220224
damian-gora FiboSearch – Ajax Search for WooCommerce < 1.17.0
dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress < 2.0.2
dgwyer Simple Sitemap – Create a Responsive HTML Sitemap < 3.5.5
dots Dynamic Pricing and Discount Rules for WooCommerce < 2.2.3
dots Fraud Prevention For WooCommerce and EDD < 2.1.0
dots Product Size Charts Plugin for WooCommerce < 2.2.3
dreamfox Payment Gateway Per Product for WooCommerce < 3.1.6
eedee WordPress Slider Block Gutenslider < 5.7.0
ethereumicoio EthereumICO < 2.3.11
galoover WordPress Animation Plugin – Animated Everything 0
hqtheme HQTheme Extra 0
interactivegeomaps MapGeo – Interactive Geo Maps < 1.5.4
ivan_paulin Country Based Payments for WooCommerce < 1.4.1
janwyl Bulk Attachment Download < 1.3.5
jcodex Any Popup – Popup Forms, Optins & Ads 0
josevega WP Required Taxonomies – Categories and Tags Mandatory < 1.1.8
kkikuchi1220 Ultimate Gutenberg – Custom Block Templates 0
krsp KRSP Frontend File Uploader 0
lostboy7 KVoucher 0
majick AutoSave Net 0
majick ForceField 0
melapress Activity Log For MainWP < 1.7.1
mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes < 3.6
mikebels LocalSEOMap 0
mvvapps/ Booking Addon for WooCommerce < 4.2.0
nicheaddons Elasta < 1.0.8
nicheaddons Events Addon for Elementor < 1.9.8
pagup MOBILOOK — Mobile View & Mobile‑Friendly Test < 1.2.4
passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization < 2.6
paulio21 Zip Code Redirect ≤ 4.0.1
pmbaldha Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin) 0
pootlepress Pootle Pagebuilder – WordPress Page builder < 5.7.1
powerfulwp Local Delivery Drivers for WooCommerce < 1.8.5
prasadkirpekar WP Free SSL < 1.2.7
premmerce Premmerce Multi-currency for Woocommerce < 2.3.2
premmerce Premmerce Wholesale Pricing for WooCommerce < 1.1.8
protectyouruploads Protect Uploads with Login – Protect Your Uploads 0
proteusthemes ConsultPress Lite 0
rafalosinski AdFoxly – Ad Manager, AdSense Ads & Ads.txt ≤ 1.8.4
richard-b FIT: Featured Image Toolkit 0
risetheme RT Easy Builder – Advanced addons for Elementor ≤ 1.4
saadiqbal WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce < 4.2.1
saadiqbal WP Contact Slider – Contact Form Slider Widget < 2.4.5
sakurapixel Atlas – Knowledge Base 0
setka A no-code page builder for beautiful performance-based content < 2.1.17
slidedeck SlideDeck: Responsive WordPress Slider Plugin 0
sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects ≤ 4.0.4
stellarwp Bookit — Booking & Appointment Calendar < 2.2.9
stevehenty WP Get Personal 0
stevejburge Tag Groups is the Advanced Way to Display Your Taxonomy Terms < 1.43.10.1
streamweasels StreamWeasels Twitch Integration < 1.3.4
surbma HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz < 30.3.0
theafricanboss/ Checkout with Cash App on EDD 0
theafricanboss/ Checkout with Venmo on EDD 0
themekraft All in One Invite Codes < 1.0.13
themelocation Custom WooCommerce Checkout Fields Editor ≤ 1.2.6
toddhalfpenny Past Events Extension 0
tribalnerd Wp My Admin Bar 0
usmanaliqureshi Server Info 0
vincoit Vit Website Reviews 0
vohotv/ Guestofy – Restaurant Reservations Plugin, Room Planer, Reservation Form 0
whiteshadow Error Log Monitor < 1.7.1
wisersteps Streak CRM For Gmail For Contact Form 7 – WordPress Plugin < 1.0.9
wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages < 1.9.9.170
wpchill Filr – Secure document library < 1.2.1
wpdever WP Notification Bell < 1.3.13
wpdevpowers WordPress Dev Powers – ACF Color Coded Field Types Plugin 0
wpengine Gutenberg Blocks – ACF Blocks Suite < 2.6.8
wpeventpartners/ WP Event Partners – WordPress Plugin for Event and Conference Management ≤ 1.2.4
wpt00ls Grid & Styler For Contact Form 7 And Divi < 1.4.1

References and patches

Recent CVEs in the same product — WordPress plugins & themes