critical9.8Public exploit code

CVE-2022-4395

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary file…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)2024-04-02 · webapps · php

Impact

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.

Affected products

Vendor	Product	Affected versions
Wpswings	Membership For Woocommerce	before 2.1.7

References

NVD record
CVE.org record
https://wpscan.com/vulnerability/80407ac4-8ce3-4df7-9c41-007b69045c40
https://packetstormsecurity.com/files/177934/WordPress-Membership-For-WooCommerce-Shell-Upload.html
https://wpscan.com/vulnerability/80407ac4-8ce3-4df7-9c41-007b69045c40
https://www.exploit-db.com/exploits/51959