CVE-2022-3537 Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload
Authenticated users can upload arbitrary files, including PHP, leading to remote code execution due to missing authorization and validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3537?
CVE-2022-3537 is a high-severity vulnerability in Unknown Role Based Pricing for WooCommerce, published on 7 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
Which versions are affected by CVE-2022-3537?
It affects 1 product.
Products include Addify Role Based Pricing for Woocommerce.
How do I fix CVE-2022-3537?
No fix has been published for CVE-2022-3537 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3537 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3537 exists.
Other vulnerabilities in Unknown Role Based Pricing for WooCommerce
Sources
Also known as GHSA-wxff-8g4p-xj2g.