CVE-2022-3416: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-3416 affects the WPtouch WordPress plugin versions before 4.3.45. The vulnerability was discovered by Nguyen Duy Quoc Khanh and was publicly disclosed on December 19, 2022. The issue lies in improper validation of image uploads, which affects the plugin's security mechanisms (WPScan).

The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The technical issue stems from insufficient validation of uploaded files in the plugin's image upload functionality, specifically in the Custom Icons feature within the Menu Settings (NVD).

When exploited, this vulnerability allows high-privilege users such as administrators to upload arbitrary files to the server, even in scenarios where such actions should be restricted, such as in multisite WordPress setups. This could potentially lead to unauthorized code execution on the affected server (WPScan).

The vulnerability has been patched in WPtouch version 4.3.45. Users are strongly advised to update their WPtouch WordPress plugin to this version or later to mitigate the security risk (WPScan).