CVE-2022-3568 is a high-severity deserialization vulnerability in the ImageMagick Engine plugin for WordPress, affecting versions up to and including 1.7.5. Unauthenticated attackers can exploit this by tricking an administrator into an action that deserializes untrusted input via the 'cli_path' parameter, potentially leading to arbitrary PHP object execution and various malicious actions if a POP chain and file upload are also present. With a CVSS score of 8.8, this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.7.6CPE matchmatch criteria | cpe:2.3:a:orangelab:imagemagick_engine:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.