CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
Explanation of Vulnerability in Simple Terms
The Custom User Registration Fields for WooCommerce plugin allows unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files—including PHP scripts—directly through the plugin's file upload functionality, gaining the ability to run their own code on the site and take full control. All versions up to 2.1.2 are affected.
What an attacker can do
Upload arbitrary files and run malicious code on the site without authentication.
Potential impact on your site
Complete site compromise. Attackers can steal data, modify content, inject malware, or lock you out.
Conditions required to exploit
None. The attacker needs only network access; no login or user interaction required.
Key dates
External resources
