CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
BerqWP versions up to 2.2.42 contain an unrestricted file upload vulnerability that allows attackers to upload malicious files to the site without authentication. An attacker can exploit this to upload PHP files or other executable content, gaining the ability to run code on the server. This affects all installations of the plugin up to the stated version.
What an attacker can do
Upload and execute malicious files on the site without needing to log in.
Potential impact on your site
Attackers can run arbitrary code on your server, potentially compromising your entire site and data.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
