CVE-2022-3912

User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload

High · published December 12, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00780 · 55.5th percentile
Published
2022-12-12T17:54Z
EPSS history
Timeline
  • 12 DEC 17:54Z
    User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
    cvelistv5