Skip to content
Fencer Vulns
medium 6.3

CVE-2022-4974 json

Freemius SDK <= 2.4.2 - Missing Authorization Checks

published 2024-10-16 2 y ago modified 2026-06-17 4 mo ago also EUVD-2022-53926

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Patch / fix

  • dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress 2.0.2
  • nicheaddons Events Addon for Elementor 1.9.8
  • dots Fraud Prevention For WooCommerce and EDD 2.1.0
  • wpengine Gutenberg Blocks – ACF Blocks Suite 2.6.8
  • bouncingsprout Ultimeter 2.7.6
  • pootlepress Pootle Pagebuilder – WordPress Page builder 5.7.1
  • powerfulwp Local Delivery Drivers for WooCommerce 1.8.5
  • josevega WP Required Taxonomies – Categories and Tags Mandatory 1.1.8
  • wisersteps Streak CRM For Gmail For Contact Form 7 – WordPress Plugin 1.0.9
  • dots Product Size Charts Plugin for WooCommerce 2.2.3
  • setka A no-code page builder for beautiful performance-based content 2.1.17
  • bplugins Panorama – 360 Virtual Tour, Panoramic image viewer and More 1.0.8
  • janwyl Bulk Attachment Download 1.3.5
  • premmerce Premmerce Wholesale Pricing for WooCommerce 1.1.8
  • dreamfox Payment Gateway Per Product for WooCommerce 3.1.6
  • daigo75 EU VAT Assistant for WooCommerce 2.0.28.220224
  • eedee WordPress Slider Block Gutenslider 5.7.0
  • surbma HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz 30.3.0
  • bplugins YT Player – Embed and Customize Video Players 1.5.1
  • whiteshadow Error Log Monitor 1.7.1
  • premmerce Premmerce Multi-currency for Woocommerce 2.3.2
  • mvvapps/ Booking Addon for WooCommerce 4.2.0
  • saadiqbal WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce 4.2.1
  • passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization 2.6
  • themekraft All in One Invite Codes 1.0.13

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

  • dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress
  • nicheaddons Events Addon for Elementor
  • dots Fraud Prevention For WooCommerce and EDD
  • wpengine Gutenberg Blocks – ACF Blocks Suite
  • bouncingsprout Ultimeter
  • toddhalfpenny Past Events Extension
  • pootlepress Pootle Pagebuilder – WordPress Page builder
  • powerfulwp Local Delivery Drivers for WooCommerce
  • kkikuchi1220 Ultimate Gutenberg – Custom Block Templates
  • josevega WP Required Taxonomies – Categories and Tags Mandatory
  • pmbaldha Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin)
  • sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
  • wisersteps Streak CRM For Gmail For Contact Form 7 – WordPress Plugin
  • wpdevpowers WordPress Dev Powers – ACF Color Coded Field Types Plugin
  • benmoreassynt DancePress (TRWA)
  • dots Product Size Charts Plugin for WooCommerce
  • tribalnerd Wp My Admin Bar
  • setka A no-code page builder for beautiful performance-based content
  • mikebels LocalSEOMap
  • cromer12 Easy Prayer
  • rafalosinski AdFoxly – Ad Manager, AdSense Ads & Ads.txt
  • stevehenty WP Get Personal
  • theafricanboss/ Checkout with Cash App on EDD
  • usmanaliqureshi Server Info
  • themelocation Custom WooCommerce Checkout Fields Editor
  • krsp KRSP Frontend File Uploader
  • bplugins Panorama – 360 Virtual Tour, Panoramic image viewer and More
  • janwyl Bulk Attachment Download
  • majick AutoSave Net
  • premmerce Premmerce Wholesale Pricing for WooCommerce
  • jcodex Any Popup – Popup Forms, Optins & Ads
  • theafricanboss/ Checkout with Venmo on EDD
  • dreamfox Payment Gateway Per Product for WooCommerce
  • hqtheme HQTheme Extra
  • vincoit Vit Website Reviews
  • daigo75 EU VAT Assistant for WooCommerce
  • eedee WordPress Slider Block Gutenslider
  • surbma HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz
  • lostboy7 KVoucher
  • bplugins YT Player – Embed and Customize Video Players
  • whiteshadow Error Log Monitor
  • slidedeck SlideDeck: Responsive WordPress Slider Plugin
  • premmerce Premmerce Multi-currency for Woocommerce
  • mvvapps/ Booking Addon for WooCommerce
  • wpeventpartners/ WP Event Partners – WordPress Plugin for Event and Conference Management
  • saadiqbal WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
  • passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization
  • majick ForceField
  • richard-b FIT: Featured Image Toolkit
  • themekraft All in One Invite Codes

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.