Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

Freemius SDK used in WordPress plugins and themes exposes sensitive data

CVE-2022-4974 · published 2 years ago
Summary

Hundreds of WordPress plugins and themes are affected. If exploited, this vulnerability could allow attackers to access sensitive information or take control of your website without your permission. Update to Freemius SDK version 2.4.3 or later to protect your website.

Original advisory text
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce pr...
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published16 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2022-4974 · NVD
Track software like this
Free during beta