CVE-2022-3679: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2022-3679) affects the Starter Templates by Kadence WP WordPress plugin versions before 1.2.17. The issue was discovered by Nguyen Pham Viet Nam and was publicly disclosed on December 16, 2022. The vulnerability involves unsafe deserialization of imported file content, which could potentially lead to PHP object injection issues (WPScan Details).

The vulnerability is classified as a PHP Object Injection (CWE-502) with a CVSS score of 5.5 (medium). The issue occurs when the plugin unserializes the content of an imported file without proper validation. This vulnerability falls under the OWASP Top 10 category A8: Insecure Deserialization (WPScan Details).

When exploited, this vulnerability could allow an attacker to execute arbitrary code through PHP object injection, provided a suitable gadget chain is present on the blog. The impact is somewhat limited as it requires admin-level access to import the malicious file (WPScan Details).

The vulnerability has been fixed in version 1.2.17 of the Starter Templates by Kadence WP plugin. Users are advised to update to this version or later to mitigate the risk (WPScan Details).