CVE-2022-2180

GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE

The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).

Affected

greyd_suite

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.58% chance of exploitation in the next 30 days, 85th percentile

Published

2022-08-15

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1

References

• CVE Record
• NVD entry