CVE-2022-3537

HIGH

Role Based Pricing for WooCommerce < 1.6.2 - Authenticated Arbitrary File Upload

Title source: llm
STIX 2.1

Description

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0050
EPSS Percentile 38.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-352 CWE-434
Status published
Products (1)
addify/role_based_pricing_for_woocommerce < 1.6.2
Published Nov 07, 2022
Tracked Since Feb 18, 2026