PT-2022-13661 · WordPress · Advanced Uploader

Roel Van Beurden · Published 2022-05-16 · Updated 2022-05-26 · CVE-2022-1103

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Uploader WordPress plugin versions prior to 4.3

Description The issue allows any authenticated users, including those with minimal privileges like subscribers, to upload arbitrary files. This includes files that can be executed by the server, such as PHP files, potentially leading to remote code execution (RCE).

Recommendations For Advanced Uploader WordPress plugin versions prior to 4.3, update to version 4.3 or later to resolve the issue.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-1103

Affected Products

Advanced Uploader

References · 4

• 🔥 https://wpscan.com/vulnerability/9ddeef95-7c7f-4296-a55b-fd3304c91c18 · Exploit
• 🔥 https://exploit-db.com/exploits/50895 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1103 · Security Note