CVE-2022-4120

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Stop Spammers Security \| Block Spam Users, Comments, Forms	< 2022.6

References

https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedfExploit, Third Party Advisory
https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedfExploit, Third Party Advisory

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-412007.8Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrus CVE-2022-412017.8Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untruste CVE-2022-412027.8Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted CVE-2022-412038.8In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privil CVE-2022-412048.8An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They ca CVE-2022-412056.1SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access t CVE-2022-412065.4SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-co CVE-2022-412076.1SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use CVE-2022-412085.4Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to a CVE-2022-412095.2SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide CVE-2022-41215.5In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to CVE-2022-412105.2SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for