CVE-2023-5601

WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload

The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.

Affected

WooCommerce Ninja Forms Product Add-ons

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.08% chance of exploitation in the next 30 days, 65th percentile

Published

2023-11-06

Updated

2025-03-25

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc

References

• CVE Record
• NVD entry