CVE-2022-2446: 
WordPress vulnerability analysis and mitigation

The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'currentthemeroot' parameter in versions up to and including 1.2.9. This vulnerability was addressed in version 1.2.9.1 released in September 2024 (WP Plugin Repo).

The vulnerability involves a PHP deserialization issue where untrusted input from the 'currentthemeroot' parameter could be processed without proper sanitization. The issue was specifically related to PHAR deserialization, as evidenced by code changes in version 1.2.9.1 that added sanitization for PHAR URLs by removing the 'phar://' scheme prefix before file operations (WP Plugin Repo).

A successful exploitation of this vulnerability could potentially allow authenticated users with administrative privileges to execute arbitrary code on the affected WordPress installation through PHP deserialization attacks (Wordfence).

Users are strongly advised to update to version 1.2.9.1 or later of the WP Editor plugin, which includes security fixes that properly sanitize inputs to prevent the deserialization vulnerability (WP Plugin Repo).