CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.
Explanation of Vulnerability in Simple Terms
The Woocommerce Wholesale Lead Capture plugin through version 2.0.3.1 does not properly validate file uploads, allowing an attacker to upload malicious files to the server. An attacker can exploit this without authentication to run their own code on the site, read sensitive data, or disrupt service. Sites using this plugin should update immediately.
What an attacker can do
Upload and execute malicious files on the server without authentication.
Potential impact on your site
Attackers can run code on your site, steal data, or take the site offline without needing a user account.
Conditions required to exploit
Network access to the plugin's upload endpoint; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
