PoC Index

CVE-2023-5601

CRITICAL 9.8EPSS 0.9%

The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.

CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.88% chance of exploitation in the next 30 days, 57th percentile
Published
2023-11-06
Updated
2025-03-25

Proof-of-concept exploits (1)

References

Related