CVE-2022-40842
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.
Risk Assessment
The risk involves potential scanning of internal networks, access to sensitive data, or attacks on other internal systems, which could lead to a security breach for the organization.
Recommendation
Immediately update the NdkAdvancedCustomizationFields plugin to the latest version that fixes this vulnerability, or temporarily disable the rotateimg.php file if an update is not available.
Other vulnerabilities in NdkAdvancedCustomizationFields
See all- CVE-2022-40841Medium
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.
- CVE-2022-40840Medium
The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.
- CVE-2022-40839High
A SQL injection vulnerability in the height and width parameters in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
Original NVD description (English source)
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.