Vulnerability identifier: #VU69414

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-43468

CWE-ID: CWE-454

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
WordPress Popular Posts
Web applications / Modules and components for CMS

Vendor: Hector Cabrera

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected plugin accepts untrusted external inputs to update certain internal variables. A remote attacker can pass specially crafted input to the application and manipulate the number of views for an article.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

WordPress Popular Posts: 1.0 - 6.0.5

---

External links
http://jvn.jp/en/jp/JVN13927745/index.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.