How severe is CVE-2022-4120?

CVE-2022-4120 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-4120 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 18% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-4120?

CVE-2022-4120 affects Trumani Stop Spammers. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-4120?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2022-4120 published?

CVE-2022-4120 was published on 2022-12-26 and last updated on 2026-06-17.

CVE-2022-4120

CVE-2022-4120 is a critical-severity vulnerability in Trumani Stop Spammers with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 18% places it in the 97th percentile, indicating an elevated likelihood of exploitation.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 18% (97th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Trumani Stop Spammers
Published: 2022-12-26
Last modified: 2026-06-17

Description

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain

Frequently asked questions

What is CVE-2022-4120?: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
How severe is CVE-2022-4120?: CVE-2022-4120 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-4120 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 18% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-4120?: CVE-2022-4120 affects Trumani Stop Spammers. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-4120?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-4120 published?: CVE-2022-4120 was published on 2022-12-26 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf

Affected products (1)

cpe:2.3:a:trumani:stop_spammers:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Trumani Stop Spammers

CVE-2023-2488 — Medium (CVSS 6.1): The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and…
CVE-2021-24245 — Medium (CVSS 6.1): The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a…
CVE-2021-24517 — Medium (CVSS 5.4): The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of…
CVE-2023-2489 — Medium (CVSS 4.8): The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and…

All CVEs affecting Trumani Stop Spammers →