CVE•Published 2022-06-13•Modified 2026-04-08•1 article on news•6 live references•NVD data

CVE-2022-1749Wpmk_ajax_finder_project · Wpmk_ajax_finder

Vulnerability data via NVD (ingested)

CVSS v3.1

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 59% of all CVEs

Weaknesses (CWE)

CWE-352Cross-Site Request Forgery (CSRF)

Description

The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.

Timeline

Published 2022-06-13

Modified 2026-04-08

External references

NVD MITRE Exploit-DB GitHub PoC trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2022-1749

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · WP plugin path

http.html:"/wp-content/plugins/wpmk-ajax-finder/"

Matches any site loading the "wpmk-ajax-finder" plugin — doesn't rely on Shodan's vuln tag.

Shodan · product

product:"Wpmk Ajax Finder Project Wpmk Ajax Finder"

All exposed Wpmk Ajax Finder Project Wpmk Ajax Finder instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Wpmk Ajax Finder"

HTTP body or banner mentions "Wpmk Ajax Finder" — catches deploys Shodan didn't identify as a product.