CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce pr...
Affects 32 products across 22 vendors.
Software does not check whether an authenticated actor has permission for the requested operation.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The Freemius SDK, used by numerous WordPress plugins and themes, is vulnerable to Cross-Site Request Forgery (CSRF) and Information Disclosure due to missing capability checks and nonce protection in certain functions.
BSID: BS-2024-GLOBAL-340091-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2022-4974?
What is the CVSS score for CVE-2022-4974?
Is CVE-2022-4974 actively exploited?
How do I remediate CVE-2022-4974?
What systems are affected by CVE-2022-4974?
| CVE ID | CVE-2022-4974 |
|---|---|
| BSID | BS-2024-GLOBAL-340091-M BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| Published | 2024-10-16 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Source: NIST NVD / MITRE CVE Database
Attackers can exploit this vulnerability to perform actions on behalf of authenticated users without their knowledge, leading to unauthorized access to sensitive information or changes to the WordPress site's configuration.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| 5Starplugins | Easy Age Verify | < 1.6.1 |
| Cleverplugins | Seo Booster | < 3.8.5 |
| Cyberhobo | Geo Mashup | < 1.13.6 |
| Daniyalahmedk | Fuse Social Floating Sidebar | < 5.4.3 |
| Deothemes | Amela | < 1.0.5 |
| Deothemes | Nokke | < 1.0.11 |
| Deothemes | Everse | < 1.8.6 |
| Deothemes | Arendelle | < 1.1.3 |
| Melapress | Wp Activity Log | < 4.4.0 |
| Mojofywp | Wp Affiliate Disclosure | < 1.2.3 |
| Nicheaddons | Primary Addon For Elementor | < 1.5.2 |
| Nicheaddons | Events Addon For Elementor | < 1.9.8 |
| Oceanwp | Ocean Extra | < 1.9.4 |
| Plugin | — | — |
| Plugins360 | All-In-One Video Gallery | < 2.5.4 |
| Prasadkirpekar | Wp Meta And Date Remover | < 1.9.6 |
| Prasadkirpekar | Wp Free Ssl | < 1.2.7 |
| Premmerce | Premmerce | < 1.3.16 |
| Premmerce | Premmerce Redirect Manager | < 1.0.7 |
| Premmerce | Premmerce Product Filter For Woocommerce | < 3.6.2 |
| Stellarwp | The Events Calendar | < 5.14.0.4 |
| Themekraft | Tk Google Fonts Gdpr Compliant | < 2.2.1 |
| Themekraft | Buddypress Woocommerce My Account Integration. Create Woocommerce Member Pages | < 3.4.2 |
| Themelocation | Widgets For Woocommerce Products On Elementor | < 1.0.9 |
| Themelocation | Custom Woocommerce Checkout Fields Editor | ≤ 1.2.6 |
| Themelocation | Remove Add To Cart Woocommerce | < 1.4.3 |
| Vanyukov | Market Exporter | ≤ 2.0.13 |
| Wordpress | — | — |
| Wpbits | Wpbits Addons For Elementor Page Builder | < 1.3.2 |
| Wpchill | Image Photo Gallery Final Tiles Grid | < 3.5.5 |
| Wpchill | Gallery Photoblocks | < 1.2.6 |
| Wpjoli | Joli Table Of Contents | < 1.3.9 |
| Xplodedthemes | Xt Ajax Add To Cart For Woocommerce | < 1.0.4 |
| Xplodedthemes | Xt Floating Cart For Woocommerce | < 2.6.3 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 19fce02107bb209b83911848ec255ff5a3c69d8f9468f6356640cabf61b6199fd6b1afec12297a6050e2382087586b2a0146fd07c4e008d3edad679e74d4a9ef |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →