← Vulnerability feed

Vulnerability record · CVE-2022-3417 · published 9 January 2023

CVE-2022-3417: Bravenewcode wptouch vulnerability

Bravenewcode · Wptouch

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.

8.8 CVSS 3.1 High EPSS 0.92% · top 41.3%
8.8CVSS 3.1 base score
0.92%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/55772932-eebd-475b-b5df-e80fab288ee5 ExploitThird Party Advisory
https://wpscan.com/vulnerability/55772932-eebd-475b-b5df-e80fab288ee5 ExploitThird Party Advisory

Track CVE-2022-3417 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2011-4803Bravenewcode wptouch sql injection vulnerabilitySQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the…EPSS 2.6%7.2CVE-2022-3416Bravenewcode wptouch vulnerabilityThe WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload ar…EPSS 17%4.3CVE-2010-4779Bravenewcode wptouch cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers…EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2022-3417), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.