CVE-2022-45359

WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

9.8 Critical

CVE-2022-45359 is a critical vulnerability (CVSS 9.8) in Yith Woocommerce Gift Cards, published December 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. No source names a fixed version.

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

13.5%Up 12.6 points since Dec 7, 2022

What each source reports

CVE List Score used 9.8

WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.

Record: CVE-2022-45359
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

EUVDEUVD-2022-48256 9.8

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.

Record: EUVD-2022-48256
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9263-c88f-rf54 9.8

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19...

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.

Record: GHSA-9263-c88f-rf54
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

NVD 9.8

Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.

Record: CVE-2022-45359
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-434
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

History

References