# Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE record · `CVE-2022-4974` - **Identifiers:** `CVE-2022-4974` - **State:** Confirmed - **Severity:** CVSS 6.3 Medium - **Critical:** No - **CNA:** Wordfence - **Weakness (CWE):** [CWE-862](https://cwe.mitre.org/data/definitions/862.html) - **Tags:** [Broken access control](https://agentprime.io/advisories/tag/access-control.md) - **Technologies:** [dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress](https://agentprime.io/advisories/technology/dashlabsltd-yasr-yet-another-star-rating-plugin-for-wordpress.md) · [nicheaddons Events Addon for Elementor](https://agentprime.io/advisories/technology/nicheaddons-events-addon-for-elementor.md) · [dots Fraud Prevention For WooCommerce and EDD](https://agentprime.io/advisories/technology/dots-fraud-prevention-for-woocommerce-and-edd.md) · [wpengine Gutenberg Blocks – ACF Blocks Suite](https://agentprime.io/advisories/technology/wpengine-gutenberg-blocks-acf-blocks-suite.md) · [bouncingsprout Ultimeter](https://agentprime.io/advisories/technology/bouncingsprout-ultimeter.md) · [toddhalfpenny Past Events Extension](https://agentprime.io/advisories/technology/toddhalfpenny-past-events-extension.md) · [pootlepress Pootle Pagebuilder – WordPress Page builder](https://agentprime.io/advisories/technology/pootlepress-pootle-pagebuilder-wordpress-page-builder.md) · [powerfulwp Local Delivery Drivers for WooCommerce](https://agentprime.io/advisories/technology/powerfulwp-local-delivery-drivers-for-woocommerce.md) · [kkikuchi1220 Ultimate Gutenberg – Custom Block Templates](https://agentprime.io/advisories/technology/kkikuchi1220-ultimate-gutenberg-custom-block-templates.md) · [josevega WP Required Taxonomies – Categories and Tags Mandatory](https://agentprime.io/advisories/technology/josevega-wp-required-taxonomies-categories-and-tags-mandatory.md) · [pmbaldha Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin)](https://agentprime.io/advisories/technology/pmbaldha-featured-products-first-for-woocommerce-a-extension-of-woocommerce-wooc.md) · [sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects](https://agentprime.io/advisories/technology/sslzen-ssl-zen-ssl-certificate-installer-https-redirects.md) · [wisersteps Streak CRM For Gmail For Contact Form 7 – WordPress Plugin](https://agentprime.io/advisories/technology/wisersteps-streak-crm-for-gmail-for-contact-form-7-wordpress-plugin.md) · [wpdevpowers WordPress Dev Powers – ACF Color Coded Field Types Plugin](https://agentprime.io/advisories/technology/wpdevpowers-wordpress-dev-powers-acf-color-coded-field-types-plugin.md) · [benmoreassynt DancePress (TRWA)](https://agentprime.io/advisories/technology/benmoreassynt-dancepress-trwa.md) · [dots Product Size Charts Plugin for WooCommerce](https://agentprime.io/advisories/technology/dots-product-size-charts-plugin-for-woocommerce.md) · [tribalnerd Wp My Admin Bar](https://agentprime.io/advisories/technology/tribalnerd-wp-my-admin-bar.md) · [setka A no-code page builder for beautiful performance-based content](https://agentprime.io/advisories/technology/setka-a-no-code-page-builder-for-beautiful-performance-based-content.md) · [mikebels LocalSEOMap](https://agentprime.io/advisories/technology/mikebels-localseomap.md) · [cromer12 Easy Prayer](https://agentprime.io/advisories/technology/cromer12-easy-prayer.md) - **Published:** 16 Oct 2024 - **Updated:** 8 Apr 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: Wordfence) at 16 Oct 2024, 06:43 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: dashlabsltd. Product: YASR – Yet Another Star Rating Plugin for WordPress. - affected: `before 2.0.2` (semver) - Other versions: unaffected - Vendor: nicheaddons. Product: Events Addon for Elementor. - affected: `before 1.9.8` (semver) - Other versions: unaffected - Vendor: dots. Product: Fraud Prevention For WooCommerce and EDD. - affected: `before 2.1.0` (semver) - Other versions: unaffected - Vendor: wpengine. Product: Gutenberg Blocks – ACF Blocks Suite. - affected: `before 2.6.8` (semver) - Other versions: unaffected - Vendor: bouncingsprout. Product: Ultimeter. - affected: `before 2.7.6` (semver) - Other versions: unaffected - Vendor: toddhalfpenny. Product: Past Events Extension. - affected: `0` - Other versions: unaffected - Vendor: pootlepress. Product: Pootle Pagebuilder – WordPress Page builder. - affected: `before 5.7.1` (semver) - Other versions: unaffected - Vendor: powerfulwp. Product: Local Delivery Drivers for WooCommerce. - affected: `before 1.8.5` (semver) - Other versions: unaffected - Vendor: kkikuchi1220. Product: Ultimate Gutenberg – Custom Block Templates. - affected: `0` - Other versions: unaffected - Vendor: josevega. Product: WP Required Taxonomies – Categories and Tags Mandatory. - affected: `before 1.1.8` (semver) - Other versions: unaffected - Vendor: pmbaldha. Product: Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin). - affected: `0` - Other versions: unaffected - Vendor: sslzen. Product: SSL Zen — SSL Certificate Installer & HTTPS Redirects. - affected: `4.0.4 and earlier` (semver) - Other versions: unaffected - Vendor: wisersteps. Product: Streak CRM For Gmail For Contact Form 7 – WordPress Plugin. - affected: `before 1.0.9` (semver) - Other versions: unaffected - Vendor: wpdevpowers. Product: WordPress Dev Powers – ACF Color Coded Field Types Plugin. - affected: `0` - Other versions: unaffected - Vendor: benmoreassynt. Product: DancePress (TRWA). - affected: `3.1.2 and earlier` (semver) - Other versions: unaffected - Vendor: dots. Product: Product Size Charts Plugin for WooCommerce. - affected: `before 2.2.3` (semver) - Other versions: unaffected - Vendor: tribalnerd. Product: Wp My Admin Bar. - affected: `0` - Other versions: unaffected - Vendor: setka. Product: A no-code page builder for beautiful performance-based content. - affected: `before 2.1.17` (semver) - Other versions: unaffected - Vendor: mikebels. Product: LocalSEOMap. - affected: `0` - Other versions: unaffected - Vendor: cromer12. Product: Easy Prayer. - affected: `0` - Other versions: unaffected - Vendor: rafalosinski. Product: AdFoxly – Ad Manager, AdSense Ads & Ads.txt. - affected: `1.8.4 and earlier` (semver) - Other versions: unaffected - Vendor: stevehenty. Product: WP Get Personal. - affected: `0` - Other versions: unaffected - Vendor: theafricanboss/. Product: Checkout with Cash App on EDD. - affected: `0` - Other versions: unaffected - Vendor: usmanaliqureshi. Product: Server Info. - affected: `0` - Other versions: unaffected - Vendor: themelocation. Product: Custom WooCommerce Checkout Fields Editor. - affected: `1.2.6 and earlier` (semver) - Other versions: unaffected - Vendor: krsp. Product: KRSP Frontend File Uploader. - affected: `0` - Other versions: unaffected - Vendor: bplugins. Product: Panorama – 360 Virtual Tour, Panoramic image viewer and More. - affected: `before 1.0.8` (semver) - Other versions: unaffected - Vendor: janwyl. Product: Bulk Attachment Download. - affected: `before 1.3.5` (semver) - Other versions: unaffected - Vendor: majick. Product: AutoSave Net. - affected: `0` - Other versions: unaffected - Vendor: premmerce. Product: Premmerce Wholesale Pricing for WooCommerce. - affected: `before 1.1.8` (semver) - Other versions: unaffected - Vendor: jcodex. Product: Any Popup – Popup Forms, Optins & Ads. - affected: `0` - Other versions: unaffected - Vendor: theafricanboss/. Product: Checkout with Venmo on EDD. - affected: `0` - Other versions: unaffected - Vendor: dreamfox. Product: Payment Gateway Per Product for WooCommerce. - affected: `before 3.1.6` (semver) - Other versions: unaffected - Vendor: hqtheme. Product: HQTheme Extra. - affected: `0` - Other versions: unaffected - Vendor: vincoit. Product: Vit Website Reviews. - affected: `0` - Other versions: unaffected - Vendor: daigo75. Product: EU VAT Assistant for WooCommerce. - affected: `before 2.0.28.220224` (semver) - Other versions: unaffected - Vendor: eedee. Product: WordPress Slider Block Gutenslider. - affected: `before 5.7.0` (semver) - Other versions: unaffected - Vendor: surbma. Product: HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz. - affected: `before 30.3.0` (semver) - Other versions: unaffected - Vendor: lostboy7. Product: KVoucher. - affected: `0` - Other versions: unaffected - Vendor: bplugins. Product: YT Player – Embed and Customize Video Players. - affected: `before 1.5.1` (semver) - Other versions: unaffected And 580 more products. The full list is on the CVE record: ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 6.3 Medium, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`, from CNA (Wordfence) - **CISA KEV:** Not listed. - **EPSS:** 0.0044, the 38th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 16 Oct 2024. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2022-4974](https://www.cve.org/CVERecord?id=CVE-2022-4974) - [NVD: CVE-2022-4974](https://nvd.nist.gov/vuln/detail/CVE-2022-4974) ### References from the CNA - - - - - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .