What the vulnerability does
01Description
The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvello_upload_csv_file function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
02Summary
The Management App for WooCommerce contains an unrestricted file upload vulnerability in versions up to 1.2.2. An authenticated user with low privileges can upload arbitrary files to the server without validation. This allows an attacker to upload malicious code, potentially gaining full control of the site. All users should update immediately.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server and run malicious code on the site.
Potential impact on your site
04Site Impact
Attackers with basic user accounts can compromise your entire WordPress site and steal or modify data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., subscriber or customer role).
Key dates
06Disclosure timeline
March 20, 2024
CVE published
April 8, 2026
Record updated
