CVE-2022-3537: Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3537?
The severity of CVE-2022-3537 is high with a CVSS score of 8.8.
What is the vulnerability description of CVE-2022-3537?
CVE-2022-3537 is a vulnerability in the Role Based Pricing for WooCommerce WordPress plugin before version 1.6.2 that allows authenticated users to upload arbitrary files, such as PHP, without proper authorization and CSRF checks.
What software is affected by CVE-2022-3537?
The Role Based Pricing for WooCommerce WordPress plugin before version 1.6.2 is affected by CVE-2022-3537.
How can the vulnerability CVE-2022-3537 be exploited?
CVE-2022-3537 can be exploited by an authenticated user, such as a subscriber, who can upload arbitrary files, such as PHP, without proper authorization and CSRF checks.
How can I fix CVE-2022-3537?
To fix CVE-2022-3537, update the Role Based Pricing for WooCommerce WordPress plugin to version 1.6.2 or above.