CVE-2022-2354

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Unknown	WP-DBManager	< 2.80.8

References

https://wpscan.com/vulnerability/1c8c5861-ce87-4813-9e26-470d63c1903aExploit, Third Party Advisory
https://wpscan.com/vulnerability/1c8c5861-ce87-4813-9e26-470d63c1903aExploit, Third Party Advisory

Timeline

Published: Aug 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-235407.6In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validatio CVE-2022-235416.3jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a p CVE-2022-235429.8OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, CVE-2022-235435.4Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate rel CVE-2022-235446.1MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance t CVE-2022-235465.5In version 2.9.0.beta14 of Discourse, an open-source discussion platform, maliciously embedded urls can leak an admin's digest of recent top CVE-2022-235479.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-235486.5Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and CVE-2022-235496.5Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and CVE-2022-23556.5The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admi CVE-2022-235515.3aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The CVE-2022-235525.4Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and