blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-4120

CRITICAL 9.8 CVSS 3.1
Published
December 26, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain

Affected products and versions

  • Unknown Stop Spammers Security | Block Spam Users, Comments, Forms — Before 2022.6
  • trumani stop_spammers — Before 2022.6

References

  • wpscan.com https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record