CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
The Woocommerce Custom Profile Picture plugin for WordPress allows authenticated users to upload files without proper validation. An attacker with a low-privilege account can upload malicious files, including PHP code, to execute arbitrary commands on the site. The vulnerability affects all versions up to 1.0 and impacts confidentiality, integrity, and availability of the entire WordPress installation.
What an attacker can do
Upload and execute malicious files (such as PHP code) on the WordPress site.
Potential impact on your site
Complete compromise of the WordPress site; attacker can read data, modify content, disable the site, or create admin accounts.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
