Critical severity9.8NVD Advisory· Published Dec 12, 2022· Updated Jun 17, 2026

CVE-2022-3900

Description

The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Boxystudio/Cooked
cpe:2.3:a:boxystudio:cooked:*:*:*:*:pro:wordpress:*:*
Range: <1.7.5.7
WordPress/Cooked Pro WordPress plugindescription
WordPress/Cooked Prollm-fuzzy
Range: <1.7.5.7
Package: https://wordpress.org/plugins/cooked-pro

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c969c4bc-82d7-46a0-88ba-e056c0b27de7nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.015
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000