Vulnerability · Published Jan 21, 2025 · Assigned by Patchstack

CVE-2025-22723WordPress Barcode Scanner and Inventory manager plugin <= 1.6.7 - Arbitrary File Upload vulnerability

Critical 9.1

In plain English

A critical-severity unrestricted file upload in Barcode Scanner with Inventory & Order Manager from Dmitry V. (CEO of "UKR Solution"). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 57.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Upload a Web Shell to a Web Server.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.7.

Affected products (as reported)

Vendor	Product	Versions
Dmitry V. (CEO of "UKR Solution")	Barcode Scanner with Inventory & Order Manager	0 – through 1.6.7

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-and-inventory-manager-plugin-1-6-7-arbitrary-file-upload-vulnerability?_s_id=cve vdb-entry