← Vulnerability feed

Vulnerability record · CVE-2022-3416 · published 9 January 2023

CVE-2022-3416: Bravenewcode wptouch vulnerability

Bravenewcode · Wptouch

The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

7.2 CVSS 3.1 High EPSS 17% · top 3.0%
7.2CVSS 3.1 base score
17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/f927dbe0-3939-4882-a469-1309ac737ee6 ExploitThird Party Advisory
https://wpscan.com/vulnerability/f927dbe0-3939-4882-a469-1309ac737ee6 ExploitThird Party Advisory

Track CVE-2022-3416 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-3417Bravenewcode wptouch vulnerabilityThe WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues wh…EPSS 0.92%7.5CVE-2011-4803Bravenewcode wptouch sql injection vulnerabilitySQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the…EPSS 2.6%4.3CVE-2010-4779Bravenewcode wptouch cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers…EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2022-3416), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.