CVE-2022-4328
CRITICAL EXPLOITED NUCLEIWooCommerce Checkout Field Manager <18.0 - Code Injection
Title source: llmExploitation Summary
CVE-2022-4328 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
Nuclei Templates (1)
WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
CRITICALVERIFIEDby theamanrawat
References (1)
Core 1
Core References
Exploit, Third Party Advisory exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed
Scores
CVSS v3
9.8
EPSS
0.0443
EPSS Percentile
90.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
VulnCheck KEV
2024-01-22
Status
published
Products (1)
najeebmedia/woocommerce_checkout_field_manager
< 18.0
Published
Mar 06, 2023
Tracked Since
Feb 18, 2026