CVE-2022-3537

Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP

Affected

Role Based Pricing for WooCommerce

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.55% chance of exploitation in the next 30 days, 45th percentile

Published

2022-11-07

Updated

2025-05-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/696868f7-409d-422d-87f4-92fc6bf6e74e

References

• CVE Record
• NVD entry