CVE-2022-4237

🗓️ 02 Jan 2023 21:49:40Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 63 Views🌐 WEB

The Welcart e-Commerce WordPress plugin before 2.8.6 allows PHAR deserialization via AJAX action

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-4237	3 Jan 202300:16	–	circl
CNNVD	WordPress plugin Welcart e-Commerce 代码问题漏洞	2 Jan 202300:00	–	cnnvd
Cvelist	CVE-2022-4237 Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation	2 Jan 202321:49	–	cvelist
EUVD	EUVD-2022-51595	3 Oct 202520:07	–	euvd
NVD	CVE-2022-4237	2 Jan 202322:15	–	nvd
OSV	CVE-2022-4237	2 Jan 202322:15	–	osv
Prion	Design/Logic Flaw	2 Jan 202322:15	–	prion
Positive Technologies	PT-2023-14111 · WordPress · Welcart E-Commerce	2 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-4237	23 May 202500:01	–	redhatcve
Vulnrichment	CVE-2022-4237 Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation	2 Jan 202321:49	–	vulnrichment

NVD

Vulners

Node

welcart welcart_e-commerceRange<2.8.6wordpress

[
  {
    "vendor": "Unknown",
    "product": "Welcart e-Commerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.8.6"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7a4b790c-49ae-46bc-9544-e188deae243f

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	AJAX deserialization payloads via Welcart vulnerable endpoint allowing PHAR deserialization by passing a phar:// URL in progressfile parameter	CWE-502
progressfile	request body	wp-admin/admin-ajax.php	AJAX deserialization payloads via Welcart vulnerable endpoint allowing PHAR deserialization by passing a phar:// URL in progressfile parameter	CWE-502

17 Jun 2026 05:20Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

EPSS0.01073

SSVC