Описание
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.7.1 (исключая)
cpe:2.3:a:atomicwebstrategy:woocommerce_ninja_forms_product_add-ons:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 74%
0.00806
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-434
Связанные уязвимости
CVSS3: 9.8
github
больше 2 лет назад
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
EPSS
Процентиль: 74%
0.00806
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-434