CVE-2023-6979

Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Cusrev

Products

Customer Reviews For Woocommerce

CVE-2023-6827

Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload

The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2023-6140 appears to be a duplicate of this issue.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

G5plus

Products

Essential Real Estate

CVE-2023-6636

Greenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'gspb_save_files' function in versions up to, and including, 7.6.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Wpsoul

Products

Greenshift

CVE-2023-6635

EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload

The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Extendify

Products

Editorskit

CVE-2023-6558

Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Webtoffee

Products

Import Export Wordpress Users

CVE-2023-6449

Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload

The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may make it possible for the file to live on the server longer. This can make remote code execution possible when combined with another vulnerability, such as local file inclusion.

CVSS 3.1 · 6.6 Medium EPSS 1.8% KEV · Not listed

Vendors

Rocklobster

Products

Contact Form 7

CVE-2023-6219

BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_process_upload' function in versions up to, and including, 1.0.76. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Reputeinfosystems

Products

Bookingpress

CVE-2023-6187

Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.

CVSS 3.1 · 7.5 High EPSS 51.3% KEV · Not listed

Vendors

Strangerstudios

Products

Paid Memberships Pro

CVE-2023-4596

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 14.3% KEV · Not listed

Vendors

Incsub

Products

Forminator

CVE-2023-4243

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation

The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations including non-repository sources onto the site, granted they are packaged as a valid WordPress plugin.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Full

Products

Full - Customer

CVE-2022-1565

Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 15.2% KEV · Not listed

Vendors

Wpallimport

Products

Wp All Import

CVE-2021-4354

PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload

The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Magazine3

Products

Pwa For Wp \& Amp

CVE-2021-4330

Envato Elements <= 2.0.10 & Template Kit <= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit – Import and versions up to and including 2.0.10 of Envato Elements & Download.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Envato

Products

Envato Elements Template Kit - Import

CVE-2020-36706

Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload

The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Simple-press Thesimplepressforumteam

Products

Simple\ Simple\

CVE-2020-36705

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 6.9% KEV · Not listed

Vendors

Tunasite

Products

Adning Advertising

CVE-2020-36701

Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload

The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

King-theme

Products

Page Builder King Composer

CVE-2019-25138

User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload

The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Plugin-planet

Products

User Submitted Posts

CVE-2024-9659

School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user_avatar_image_upload() function in all versions up to, and including, 91.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed

Vendors

Dasinfomedia

Products

School Management System

CVE-2024-8242

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inspireui

Products

Mstore Api

CVE-2024-8856

Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 94.1% KEV · Not listed

Vendors

Revmakx

Products

Backup And Staging By Wp Time Capsule