Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF

published 2022-03-28 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15636

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

wpscan.com https://wpscan.com/vulnerability/e9ccf1fc-1dbf-4a41-bf4a-90af20b286d6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Unknown Sermon Browser

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-352 Cross-Site Request Forgery

Technology feeds

WordPress rss critical rss

References

wpscan.com /vulnerability/e9ccf1fc-1dbf-4a41-bf4a-90af20b286d6
exploit, third-party-advisory

Sources

CVE List CVE-2022-0499
NVD CVE-2022-0499

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary