← Vulnerability feed

Vulnerability record · CVE-2022-4120 · published 26 December 2022

CVE-2022-4120: Trumani stop spammers vulnerability

Trumani · Stop Spammers

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain

9.8 CVSS 3.1 Critical EPSS 18% · top 2.9%
9.8CVSS 3.1 base score
18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf ExploitThird Party Advisory
https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf ExploitThird Party Advisory

Track CVE-2022-4120 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.1CVE-2023-2488Trumani stop spammers vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before ou…EPSS 0.52%6.1CVE-2021-24245Trumani stop spammers cross-site scripting vulnerabilityThe Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an…EPSS 5.7%5.4CVE-2021-24517Trumani stop spammers cross-site scripting vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high pr…EPSS 0.62%4.8CVE-2023-2489Trumani stop spammers vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which …EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2022-4120), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.