CVE-2022-4328

published 2023-03-06

CVE-2022-4328: The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to…

Priority P1 86 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

Affected

1 ranges

Vendor	Product	Version range	Fixed in
najeebmedia	woocommerce_checkout_field_manager	< 18.0	18.0

Detection & IOCs extracted from sources · hover to see the quote

path /wp-content/uploads/cfom_files/↗

• → Monitor for PHP file uploads to the cfom_files upload directory, which is the target path for arbitrary file upload exploitation of this vulnerability. ↗
• → The vulnerability allows unauthenticated attackers to upload arbitrary files including PHP webshells; detect unauthenticated POST requests that result in .php files appearing under /wp-content/uploads/cfom_files/. ↗

• · The plugin is vulnerable in versions before 18.0; ensure the installed version of WooCommerce Checkout Field Manager is checked against this threshold when triaging alerts. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434