CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooCommerce Easy Checkout Field Editor, Fees & Discounts: from n/a through 3.5.12.
Explanation of Vulnerability in Simple Terms
The WooCommerce Easy Checkout Field Editor, Fees & Discounts plugin through version 3.5.12 does not properly validate file uploads, allowing an attacker to upload malicious files without authentication. An attacker can upload a PHP file or other executable code to the server and run it, compromising the entire WordPress site. This vulnerability requires no user interaction and can be exploited remotely.
What an attacker can do
Upload and execute malicious files on your server without logging in.
Potential impact on your site
Complete site compromise: attacker can run code, steal data, modify content, or take the site offline.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
