CVE-2022-3537

🗓️ 07 Nov 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 53 Views🌐 WEB

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 allows arbitrary file upload

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-3537	7 Nov 202212:34	–	circl
CNNVD	WordPress plugin Role Based Pricing for WooCommerce 代码问题漏洞	7 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-3537 Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload	7 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-42903	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3537	7 Nov 202210:15	–	nvd
Patchstack	WordPress Role Based Pricing for WooCommerce premium plugin <= 1.6.1 - Auth. Arbitrary File Upload vulnerability	17 Oct 202200:00	–	patchstack
Prion	Cross site request forgery (csrf)	7 Nov 202210:15	–	prion
Positive Technologies	PT-2022-22771 · WordPress · Role Based Pricing For Woocommerce	7 Nov 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-3537	22 May 202523:01	–	redhatcve
Vulnrichment	CVE-2022-3537 Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload	7 Nov 202200:00	–	vulnrichment

NVD

Vulners

Node

addify role_based_pricing_for_woocommerceRange<1.6.2wordpress

[
  {
    "vendor": "Unknown",
    "product": "Role Based Pricing for WooCommerce",
    "versions": [
      {
        "version": "1.6.2",
        "status": "affected",
        "lessThan": "1.6.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/696868f7-409d-422d-87f4-92fc6bf6e74e

Parameter	Position	Path	Description	CWE
afcsp_import_file	request body	wp-admin/admin-ajax.php?action=afcsp_upload_csv	Unauthenticated/low-privilege user can upload arbitrary files due to missing authorization/CSRF checks and file validation	CWE-352, CWE-434

01 May 2025 20:15Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

EPSS0.00174

SSVC