Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated at...

CVE-2022-3900 · published 3 years ago
Summary

The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.

What to do
  • Update boxystudio cooked to version 1.7.5.7 or later.
Affected software
VendorProductAffected versions
boxystudio cooked < 1.7.5.7
cpe:2.3:a:boxystudio:cooked:*:*:*:*:pro:wordpress:*:*
Original advisory text
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated at...
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
19% chance of attack within 30 days
Timeline
Published12 Dec 2022
Updated30 Sep 2026
First seen29 Sep 2026
Sources
CVE-2022-3900 · NVD
Track software like this
Free during beta