CVE-2022-0499

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p48

Published

Mar 28, 2022 (Mar 28, 2022)

Modified

Jun 17, 2026

Description

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.

Vendors: sermon browser project
Products: sermon browser
Ecosystems: WordPress
Weakness: CWE-352, CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.