blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-4328

CRITICAL 9.8 CVSS 3.1
Published
March 6, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

Affected products and versions

  • Unknown WooCommerce Checkout Field Manager — Before 18.0
  • najeebmedia woocommerce_checkout_field_manager — Before 18.0

References

  • wpscan.com https://wpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record