CVE-2022-1574 HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

2022-06-2708:57:00

WPScan

www.cve.org

9.9 High

AI Score

Confidence

High

0.05 Low

EPSS

Percentile

92.9%

JSON

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "HTML2WP",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "1.0.0"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]