CVE record · CVE-2022-4974

Freemius SDK <= 2.4.2 - Missing Authorization Checks

CVSS 6.3 MediumEPSS 0.0044 · 38th percentile

Published by the CVE Program (CNA: Wordfence) at 16 Oct 2024, 06:43 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
dashlabsltd	YASR – Yet Another Star Rating Plugin for WordPress	affected before 2.0.2 semver Other versions: unaffected
nicheaddons	Events Addon for Elementor	affected before 1.9.8 semver Other versions: unaffected
dots	Fraud Prevention For WooCommerce and EDD	affected before 2.1.0 semver Other versions: unaffected
wpengine	Gutenberg Blocks – ACF Blocks Suite	affected before 2.6.8 semver Other versions: unaffected
bouncingsprout	Ultimeter	affected before 2.7.6 semver Other versions: unaffected
toddhalfpenny	Past Events Extension	affected 0 Other versions: unaffected
pootlepress	Pootle Pagebuilder – WordPress Page builder	affected before 5.7.1 semver Other versions: unaffected
powerfulwp	Local Delivery Drivers for WooCommerce	affected before 1.8.5 semver Other versions: unaffected
kkikuchi1220	Ultimate Gutenberg – Custom Block Templates	affected 0 Other versions: unaffected
josevega	WP Required Taxonomies – Categories and Tags Mandatory	affected before 1.1.8 semver Other versions: unaffected
pmbaldha	Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin)	affected 0 Other versions: unaffected
sslzen	SSL Zen — SSL Certificate Installer & HTTPS Redirects	affected 4.0.4 and earlier semver Other versions: unaffected
wisersteps	Streak CRM For Gmail For Contact Form 7 – WordPress Plugin	affected before 1.0.9 semver Other versions: unaffected
wpdevpowers	WordPress Dev Powers – ACF Color Coded Field Types Plugin	affected 0 Other versions: unaffected
benmoreassynt	DancePress (TRWA)	affected 3.1.2 and earlier semver Other versions: unaffected
dots	Product Size Charts Plugin for WooCommerce	affected before 2.2.3 semver Other versions: unaffected
tribalnerd	Wp My Admin Bar	affected 0 Other versions: unaffected
setka	A no-code page builder for beautiful performance-based content	affected before 2.1.17 semver Other versions: unaffected
mikebels	LocalSEOMap	affected 0 Other versions: unaffected
cromer12	Easy Prayer	affected 0 Other versions: unaffected
rafalosinski	AdFoxly – Ad Manager, AdSense Ads & Ads.txt	affected 1.8.4 and earlier semver Other versions: unaffected
stevehenty	WP Get Personal	affected 0 Other versions: unaffected
theafricanboss/	Checkout with Cash App on EDD	affected 0 Other versions: unaffected
usmanaliqureshi	Server Info	affected 0 Other versions: unaffected
themelocation	Custom WooCommerce Checkout Fields Editor	affected 1.2.6 and earlier semver Other versions: unaffected
krsp	KRSP Frontend File Uploader	affected 0 Other versions: unaffected
bplugins	Panorama – 360 Virtual Tour, Panoramic image viewer and More	affected before 1.0.8 semver Other versions: unaffected
janwyl	Bulk Attachment Download	affected before 1.3.5 semver Other versions: unaffected
majick	AutoSave Net	affected 0 Other versions: unaffected
premmerce	Premmerce Wholesale Pricing for WooCommerce	affected before 1.1.8 semver Other versions: unaffected
jcodex	Any Popup – Popup Forms, Optins & Ads	affected 0 Other versions: unaffected
theafricanboss/	Checkout with Venmo on EDD	affected 0 Other versions: unaffected
dreamfox	Payment Gateway Per Product for WooCommerce	affected before 3.1.6 semver Other versions: unaffected
hqtheme	HQTheme Extra	affected 0 Other versions: unaffected
vincoit	Vit Website Reviews	affected 0 Other versions: unaffected
daigo75	EU VAT Assistant for WooCommerce	affected before 2.0.28.220224 semver Other versions: unaffected
eedee	WordPress Slider Block Gutenslider	affected before 5.7.0 semver Other versions: unaffected
surbma	HuCommerce \| Magyar kiegészítések WooCommerce webáruházakhoz	affected before 30.3.0 semver Other versions: unaffected
lostboy7	KVoucher	affected 0 Other versions: unaffected
bplugins	YT Player – Embed and Customize Video Players	affected before 1.5.1 semver Other versions: unaffected

And 580 more products. The full list is on the CVE record.

Identifiers: CVE-2022-4974
CNA: Wordfence
Weakness (CWE): CWE-862
Tags: dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress
nicheaddons Events Addon for Elementor
dots Fraud Prevention For WooCommerce and EDD
wpengine Gutenberg Blocks – ACF Blocks Suite
bouncingsprout Ultimeter
toddhalfpenny Past Events Extension
pootlepress Pootle Pagebuilder – WordPress Page builder
powerfulwp Local Delivery Drivers for WooCommerce
Broken access control
Published: 16 Oct 2024
Updated: 8 Apr 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.3	Medium	3.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	CNA (Wordfence)

CISA KEV Not listed.
EPSS 0.0044, the 38th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 16 Oct 2024. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.