CVE-2022-36285 HIGH

CVE-2022-36285: WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

Vendor Dmitrylitvinov
Product Uploading SVG, WEBP and ICO files (WordPress plugin)
Weakness CWE-434 · Unrestricted file upload
Published August 23, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

An authenticated administrator can upload files with unrestricted types to this WordPress plugin, potentially including executable code. The plugin does not properly validate file uploads, allowing an attacker with admin privileges to bypass intended restrictions. This can lead to remote code execution if malicious files are processed by the server.

What an attacker can do

03Attacker Capabilities

Upload and execute arbitrary files on the site, including PHP code.

Potential impact on your site

04Site Impact

A compromised admin account can be used to take full control of your site and server.

Conditions required to exploit

05Prerequisites

Attacker must have WordPress administrator access.

Key dates

06Disclosure timeline

August 23, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6960 BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field CVE-2026-6933 Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation CVE-2026-63048 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 CVE-2026-15282 Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload CVE-2026-9227 GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter