CVE-2022-3899

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-389907.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.CVE-2022-389917.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-389927.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-389937.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.CVE-2022-389947.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-389957.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.CVE-2022-389967.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.CVE-2022-389977.5The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-389987.5The HISP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability CVE-2022-389999.8The AOD module has the improper update of reference count vulnerability. Successful exploitation of this vulnerability may affect data integCVE-2022-39009.8The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in tCVE-2022-390009.8The iAware module has a vulnerability in managing malicious apps.Successful exploitation of this vulnerability will cause malicious apps to
CVE-2022-3899: High severity, CVSS 8.1 | Vulnix