WordPress security changelog
HIGH CVE-2022-2444 Modified

Visualizer: Tables and Charts Manager for: Code execution

Visualizer: Tables and Charts Manager for is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score 8.8 CVSS 3.1 · nvd@nist.gov
Component
Visualizer: Tables and Charts Manager for
Plugin slug
visualizer
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Jul 18, 2022
Weakness
CWE-502 — Deserialization of Untrusted Data

This CVE was published Jul 18, 2022 and is one of 13 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Visualizer: Tables and Charts Manager for to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources