CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
Explanation of Vulnerability in Simple Terms
Import Export For WooCommerce versions up to 1.6.2 allow authenticated users to upload files without proper validation. An attacker with low-level site access can upload malicious files, including PHP code, to execute arbitrary commands on the server. The vulnerability affects confidentiality, integrity, and availability of the entire site.
What an attacker can do
Upload and execute malicious files (including PHP code) on the server to take control of the site.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, install backdoors, or take the site offline.
Conditions required to exploit
Attacker needs a low-privilege account (e.g., subscriber or contributor role) on the WordPress site.
Key dates
External resources
Related vulnerabilities
