CVE-2022-0499

Name of the Vulnerable Software and Affected Versions Sermon Browser WordPress plugin versions 0.45.22 and earlier

Description The issue allows attackers to make a logged-in admin upload arbitrary files, such as PHP files, due to the lack of CSRF checks and file validation when uploading Sermon files. This can be exploited by attackers to upload malicious files.

Recommendations For Sermon Browser WordPress plugin versions 0.45.22 and earlier, consider disabling the file upload feature until a patch is available to prevent exploitation. Restrict access to the file upload functionality to minimize the risk of arbitrary file uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.