Lucene search
HistoryNov 07, 2022 - 10:15 a.m.
CVE-2022-3537
woocommerce
wordpress
plugin
authorization
csrf
file upload
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
32.6%
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
Affected configurations
Node
addifyrole_based_pricing_for_woocommerceRange<1.6.2wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| addify | role_based_pricing_for_woocommerce | * | cpe:2.3:a:addify:role_based_pricing_for_woocommerce:*:*:*:*:*:wordpress:*:* |
Related
prion
prion
Cross site request forgery (csrf)
2022-11-07 10:15:00
wpexploit
wpexploit
cvelist
cvelist
cve
cve
CVE-2022-3537
2022-11-07 10:15:12
patchstack
patchstack
wpvulndb
wpvulndb
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
32.6%
Related for NVD:CVE-2022-3537