{"id":"CVE-2022-3921","aliases":["EUVD-2022-43255","GHSA-frm5-37j3-v45h"],"status":"published","title":"Listingo \u003c 3.2.7 - Unauthenticated Arbitrary File Upload","description":"The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.21205,"percentile":0.9762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2022-12-12T17:57:09Z","modified":"2026-06-17T05:00:35Z","products":[{"vendor":"themographics","product":"listingo"},{"vendor":"unknown","product":"listingo"}],"references":[{"url":"https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3921"},{"url":"https://github.com/advisories/GHSA-frm5-37j3-v45h"}],"sources":{"cve":[{"id":"CVE-2022-3921","title":"Listingo \u003c 3.2.7 - Unauthenticated Arbitrary File Upload","description":"The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE","status":"published","published":"2022-12-12T17:57:09.917Z","modified":"2025-04-22T14:42:28.536Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-43255","description":"The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE","status":"published","published":"2022-12-12T17:57:09Z","modified":"2025-04-22T14:42:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:17.280298Z"}],"ghsa":[{"id":"GHSA-frm5-37j3-v45h","title":"The does not validate files to be uploaded via an AJAX action available to unauthenticated users,...","description":"The does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE","status":"published","published":"2022-12-12T18:30:27Z","modified":"2023-01-30T05:05:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:47:18.801591Z"}],"nvd":[{"id":"CVE-2022-3921","description":"The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE","status":"published","published":"2022-12-12T18:15:11.97Z","modified":"2026-06-17T05:00:35.153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:33.649381Z"}]}}