CVE-2022-3416 WPtouch < 4.3.45 - Admin+ Arbitrary File Upload

2023-01-0922:13:28

WPScan

www.cve.org

cve-2022-3416

wptouch

arbitrary file upload

admin

multisite

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.8%

JSON

The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WPtouch",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.3.45"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/f927dbe0-3939-4882-a469-1309ac737ee6