Description
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WooCommerce Checkout Field Manager | < 18.0 | 18.0 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload http/cves/2022/CVE-2022-4328.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed exploit vdb-entry technical-description