Paper/Archive/CVE-2022-4328

CVE-2022-4328

Unknown WooCommerce Checkout Field Manager — WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload

EPSS 4%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 91.4.914 × 2018.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

Affected

ProductAffectedFixed inSource

WooCommerce Checkout Field Manager< 18.018.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed