Approved changes feed: RSS · Atom
cpe:2.3:a:benjaminprojas:wp_editor:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Benjaminprojas (e7a801c8-23ca-56a9-b53f-389f8c4353a6) |
|---|---|
| Product | Wp Editor (ecd6d4ae-9d57-5da2-a489-bb05ff90e56b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3772 |
vulnerable | 2026-06-08 08:01:19.358150 |
WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
HIGH (8.8)
The WP Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9.2. This is due to missing nonce verification in the 'add_plugins_page' and 'add_themes_page' functions. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin and theme PHP files with attacker-controlled code via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Published: 2026-05-01T11:18:47.686Z
Updated: 2026-05-01T16:35:20.995Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3295 |
vulnerable | 2026-06-08 07:23:08.600108 |
WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
MEDIUM (4.9)
The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information.
Published: 2025-04-17T05:23:19.325Z
Updated: 2026-04-08T16:49:45.110Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3294 |
vulnerable | 2026-06-08 07:23:08.598646 |
WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update
HIGH (7.2)
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
Published: 2025-04-17T05:23:19.895Z
Updated: 2026-04-08T17:09:29.025Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2446 |
vulnerable | 2026-06-08 05:43:35.571603 |
WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization
HIGH (7.2)
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Published: 2024-09-13T15:10:43.938Z
Updated: 2026-04-08T17:32:49.427Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.