CVE-2022-3537 — Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload

CVE-2022-3537

Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload PUBLISHED

Description (CNA)

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP

Affected (CNA)

Vendor / product	Versions
Unknown / Role Based Pricing for WooCommerce	affected 1.6.2 before 1.6.2

CWE

CWE-434, CWE-352

References

https://wpscan.com/vulnerability/696868f7-409d-422d-87f4-92fc6bf6e74e

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/696868f7-409d-422d-87f4-92fc6bf6e74e

CISA-ADP

No English description supplied.

No references supplied.