CVE-2022-3537CWE-352CWE-434

Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload

High · published November 7, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-11-07T00:00Z
EPSS history
Timeline
  • 07 NOV 00:00Z
    Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload
    cvelistv5