CVE-2022-3912 User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload

2022-12-1217:54:35

WPScan

www.cve.org

cve-2022-3912

user registration

wordpress plugin

0.002 Low

EPSS

Percentile

53.0%

JSON

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "User Registration",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.2.4.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/968c677c-1beb-459b-8fd1-7f70bcaa4f74

0.002 Low

EPSS

Percentile

53.0%

JSON

Related for CVELIST:CVE-2022-3912