CVE-2022-1574

CRITICALNuclei

HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1574 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 18, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

HTML2WP

Default status: affected

CVE ListThrough 1.0.0affected

html2wp

Browse html2wp_project / html2wp
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress HTML2WP <=1.0.0 - Arbitrary File UploadCVSS 9.8

WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.

Impact

An attacker can upload malicious files to the server, leading to remote code execution or unauthorized access.

Remediation

Update to the latest version of the plugin or remove it if not needed.

WeaknessesCWE-352
Authorstheamanrawat
Template tagscvecve2022wp-pluginwpfileuploadunauthwpscanwordpressintrusivehtml2wphtml2wp_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:html2wp_project:html2wp:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14 https://wordpress.org/plugins/html2wp/ https://nvd.nist.gov/vuln/detail/CVE-2022-1574 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2