CVE-2022-3536

CVE-2022-3536: Role Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR Deserialization

Vendor Unknown

Product Role Based Pricing for WooCommerce

Weakness CWE-502 · Unsafe deserialization

Published November 7, 2022

Last update May 1, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog

Key dates

02Disclosure timeline

November 7, 2022 CVE published

May 1, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3536 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2025-15276 FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-54742 WordPress WpEvently Plugin <= 4.4.8 - PHP Object Injection Vulnerability CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import CVE-2025-49712 Microsoft SharePoint Remote Code Execution Vulnerability CVE-2024-7351 Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection