CVE-2023-5957

Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution

The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.

Affected

Ni Purchase Order(PO) For WooCommerce

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.88% chance of exploitation in the next 30 days, 58th percentile

Published

2024-01-08

Updated

2025-06-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/70f823ff-64ad-4f05-9eb3-b69b3b79dc12

References

• CVE Record
• NVD entry