CVE-2022-3921 Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files via an AJAX action in the Listingo WordPress theme, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3921?
CVE-2022-3921 is a critical vulnerability in Unknown Listingo, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
Which versions are affected by CVE-2022-3921?
It affects 1 product.
Products include Themographics Listingo.
How do I fix CVE-2022-3921?
No fix has been published for CVE-2022-3921 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3921 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3921 exists.
Sources
Also known as GHSA-frm5-37j3-v45h.