PatchTheCVECVE-2022-1560: The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in
CVE-2022-1560 is a medium-severity flaw (CVSS 6.5) affecting amministrazione aperta. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a l
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 2.3% (top 17%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2022-05-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-1560?
amministrazione aperta: upgrade to 3.8. Exact commands for each OS are on this page.
Is CVE-2022-1560 being exploited?
CVE-2022-1560 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-1560 affect?
CVE-2022-1560 affects amministrazione aperta. Severity is medium (CVSS 6.5). The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can expl
How urgent is CVE-2022-1560?
Priority 49/100. Public exploit reference