RCE in Vr Calendar

CVE-2022-2314

The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.808 (99.2th percentile) — read the EPSS interpretation.

Affected products

Unknown Vr Calendar — versions 2.3.2

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

References

wpscan.com/vulnerability/b22fe77c-844e-4c24-8023-014441cc1e82 (x_refsource_MISC)

Frequently asked questions

What is CVE-2022-2314?: CVE-2022-2314 is a vulnerability in Vr Calendar, classified under OS Command Injection. Published 2022-08-15.
Is CVE-2022-2314 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.