Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection
Priority HIGH 67CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.
Summary
The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01485 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Easy WP SMTP (Unknown): 1.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Easy WP SMTP | 1.5.0 to before 1.5.0 | 1.5.0 | Patch available | CNA |
- Easy WP SMTP VendorUnknown Affected 1.5.0 to before 1.5.0 Fixed in 1.5.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:* | before 1.5.0 | Vulnerable | WPecommerce, Alexanderfoxc |
- cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:* Versions before 1.5.0 Vulnerable ·WPecommerce, Alexanderfoxc
Remediation
- Fix · CNA Easy WP SMTP (Unknown) Fixed in 1.5.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3334
- 2026-10-03 Alias added: GHSA-c9vr-62wv-7xw6
References
More WPecommerce, Alexanderfoxc Easy Wp Smtp vulnerabilities
- TI-2020-17910 The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover… CVSS 3.1HIGH 7.5
- TI-2019-15244 Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update CVSS 3.1CRITICAL 9.8
- TI-2022-20738 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
- TI-2022-22633 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion CVSS 3.1HIGH 8.7
- TI-2022-22637 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal CVSS 3.1MEDIUM 6.8
- TI-2017-05348 XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2022-3334 · CVE Program
- CVE-2022-3334 · NVD
- FIRST EPSS
- GHSA-c9vr-62wv-7xw6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences