CVE-2022-40842

CriticalCVSS 9.1

Published: 22/11/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

52th percentile - higher than 52% of all known CVEs

Summary

The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.

Risk Assessment

The risk involves potential scanning of internal networks, access to sensitive data, or attacks on other internal systems, which could lead to a security breach for the organization.

Recommendation

Immediately update the NdkAdvancedCustomizationFields plugin to the latest version that fixes this vulnerability, or temporarily disable the rotateimg.php file if an update is not available.

Original NVD description (English source)

ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.