CVE-2022-4395 Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload

2023-01-3020:31:42

WPScan

www.cve.org

woocommerce

unauthenticated

arbitrary file upload

rce

cve-2022-4395

wordpress

plugin

file validation

AI Score

9.9

Confidence

High

EPSS

0.05

Percentile

93.0%

JSON

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Membership For WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.1.7"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]