VULNERABILITY INTELLIGENCE

CVE-2022-3537

CVSS score8.8 HIGH
EPSS probability0.55%
CISA KEVNot currently listed
Published2022-11-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references