blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-2180

CRITICAL 9.8 CVSS 3.1
Published
August 15, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).

Affected products and versions

  • Unknown greyd_suite — From 1.2.7 (including) to 1.2.7 (excluding)
  • greyd greyd.suite — Before 1.2.7

References

  • wpscan.com https://wpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record