CVE-2022-3921

Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE

Affected

Listingo

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

21.20% chance of exploitation in the next 30 days, 98th percentile

Published

2022-12-12

Updated

2025-04-22

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f

References

• CVE Record
• NVD entry