RCE in Simplemachines Simple Machines Forum
CVE-2022-26982
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.092 (94.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Simplemachines Simple_machines_forum
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org
Frequently asked questions
- What is CVE-2022-26982?
- CVE-2022-26982 is a high-severity vulnerability in Simplemachines Simple Machines Forum, classified under Code Injection. CVSS score: 7.2/10. Published 2022-04-05.
- How severe is CVE-2022-26982?
- High severity. CVSS v3 base score is 7.2 out of 10.