CVE-2022-2437 – This vulnerability in the Feed Them Social Word... (How to Fix)

📋 TL;DR

This vulnerability in the Feed Them Social WordPress plugin allows unauthenticated attackers to execute arbitrary PHP code via deserialization of untrusted input. Attackers can exploit this by uploading a malicious file and triggering deserialization through the 'fts_url' parameter. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Feed Them Social - for Twitter feed, Youtube and more WordPress plugin

Versions: Versions up to and including 2.9.8.5

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker to successfully upload a malicious file and have a POP chain available

📦 What is this software?

Feed Them Social by Slickremix

View all CVEs affecting Feed Them Social →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise leading to data theft, ransomware deployment, or website defacement

🟠

Likely Case

Remote code execution allowing backdoor installation, data exfiltration, or cryptocurrency mining

🟢

If Mitigated

Attack fails due to file upload restrictions or lack of POP chain

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing and the exploit requires no authentication

🏢 Internal Only: LOW - WordPress plugins are primarily used on public-facing websites

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploit requires file upload capability and suitable POP chain, but CVSS 9.8 indicates high exploitability

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.8.6 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754749%40feed-them-social&new=2754749%40feed-them-social

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Feed Them Social'
4. Click 'Update Now' if available
5. If no update shows, download version 2.9.8.6+ from WordPress.org
6. Deactivate, delete old version, upload new version, activate

🔧 Temporary Workarounds

Disable plugin

all

Temporarily deactivate the vulnerable plugin until patched

wp plugin deactivate feed-them-social

Restrict file uploads

all

Implement strict file upload controls to prevent malicious file upload

🧯 If You Can't Patch

Remove or disable the Feed Them Social plugin entirely
Implement web application firewall rules to block requests containing 'fts_url' parameter with PHAR wrapper

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Feed Them Social → Version number. If version is 2.9.8.5 or lower, you are vulnerable.

Check Version:

wp plugin get feed-them-social --field=version

Verify Fix Applied:

Verify plugin version is 2.9.8.6 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

HTTP requests containing 'fts_url' parameter with PHAR:// wrapper
File upload attempts to WordPress upload directories
Unexpected PHP process execution

Network Indicators:

POST requests to WordPress admin-ajax.php with suspicious parameters
Outbound connections from web server to unknown IPs

SIEM Query:

source="web_logs" AND (uri="*admin-ajax.php*" AND params="*fts_url=phar://*")

📊 Metadata

CVE ID: CVE-2022-2437

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: July 18, 2022

Last Updated: May 5, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-2437, you might also want to check these: