PT-2023-32205 · WordPress · Woocommerce Ninja Forms Product Add-Ons

Alexander Concha · Publicado 2023-10-18 · Atualizado 2025-03-25 · CVE-2023-5601

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce Ninja Forms Product Add-ons version 1.7.1 and earlier

Description The issue concerns the WooCommerce Ninja Forms Product Add-ons WordPress plugin, which does not validate the file to be uploaded. This allows any unauthenticated users to upload arbitrary files to the server, leading to Remote Code Execution (RCE).

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. As a temporary workaround, consider disabling file upload functionality until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-5601

Produtos afetados

Woocommerce Ninja Forms Product Add-Ons

Referências · 6

• 🔥 https://wpscan.com/vulnerability/0035ec5e-d405-4eb7-8fe4-29dd0c71e4bc · Exploit
• https://twitter.com/VulmonFeeds/status/1714812168267288967 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5601 · Aviso do Fabricante
• https://t.me/cibsecurity/73655 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-5601 · Nota de Segurança
• https://t.me/cvenotify/116234 · Publicação no Telegram