Vulnerability · Published Nov 6, 2023 · Assigned by WPScan
CVE-2023-5601WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity security flaw in WooCommerce Ninja Forms Product Add-ons from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.1%top 34.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WooCommerce Ninja Forms Product Add-ons | 0 – before 1.7.1 |
References
- https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc exploit, vdb-entry, technical-description