CVE-2022-3879

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p27

Published

Dec 12, 2022 (Dec 12, 2022)

Modified

Jun 17, 2026

Description

The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org

Vendors: car dealer project
Products: car dealer
Ecosystems: WordPress
Weakness: CWE-352, CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.