CVE-2022-0863 WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)

2022-06-1312:41:37

CWE-434

WPScan

www.cve.org

wp svg icons

wordpress

remote code execution

cve-2022-0863

admin

security vulnerability

EPSS

0.003

Percentile

71.7%

JSON

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.

CNA Affected

[
  {
    "product": "WP SVG Icons",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "3.2.3",
        "status": "affected",
        "version": "3.2.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/a30212a0-c910-4657-aee1-4a2d72c77983

EPSS

0.003

Percentile

71.7%

JSON

Related for CVELIST:CVE-2022-0863