CVE-2022-3989

Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload

High · published December 12, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01123 · 66.0th percentile
Published
2022-12-12T17:54Z
EPSS history
Timeline
  • 12 DEC 17:54Z
    Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload
    cvelistv5