CVE-2022-3921
Published: 12 December 2022
Summary
CVE-2022-3921 is a critical-severity an unspecified weakness vulnerability in Themographics Listingo. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Listingo WordPress theme before version 3.2.7 is affected by a vulnerability in which files uploaded via an AJAX action available to unauthenticated users are not validated. This permits arbitrary file uploads that can lead directly to remote code execution, reflected in the CVSS 3.1 score of 9.8.
Unauthenticated attackers can send crafted requests to the exposed AJAX endpoint, upload malicious files, and achieve code execution on the server with full confidentiality, integrity, and availability impact.
The EPSS score rose from lower values to a peak of 0.3532 on 2025-12-18 before receding to the current 0.0785, indicating that exploitation interest emerged well after the 2022 disclosure and that the CVE warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-43255
Vulnerability details
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.