CVE-2022-3879

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352 CWE-863

Affected software

Vendor	Product	Versions
Unknown	Car Dealer (Dealership) and Vehicle sales WordPress Plugin	< 3.05

References

https://wpscan.com/vulnerability/0db1762e-1401-4006-88ed-d09a4bc6585bExploit, Third Party Advisory
https://wpscan.com/vulnerability/0db1762e-1401-4006-88ed-d09a4bc6585bExploit, Third Party Advisory

Timeline

Published: Dec 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-387905.4Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the CVE-2022-387915.5In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which CVE-2022-387929.8The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.CVE-2022-387947.5Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.CVE-2022-387956.5In Gitea through 1.17.1, repo cloning can occur in the migration function.CVE-2022-387966.1A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusin CVE-2022-38806.5The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have pr CVE-2022-388015.4In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.CVE-2022-388026.2Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, CVE-2022-388036.8Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employ CVE-2022-388088.8ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.CVE-2022-38815.7The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin b