CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
Easy Upload Files During Checkout contains an unrestricted file upload vulnerability affecting versions 2.9.8 and earlier. An attacker can upload arbitrary files to the site without authentication or user interaction. This allows execution of malicious code, data theft, or site takeover. Update to a version newer than 2.9.8 immediately.
What an attacker can do
Upload and execute arbitrary files on your site without logging in.
Potential impact on your site
Complete site compromise: attackers can run code, steal data, or deface your site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
