Vulnerability · Published Dec 12, 2022 · Assigned by WPScan
CVE-2022-3921Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity security flaw in Listingo from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 21.2% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)21.2%top 2.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
Affected products (as reported)
References
- https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f exploit, vdb-entry, technical-description