{"id":"CVE-2022-4328","aliases":["EUVD-2022-51681","GHSA-mqr5-jg85-4hvx"],"status":"published","title":"WooCommerce Checkout Field Manager \u003c 18.0 - Unauthenticated Arbitrary File Upload","description":"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04427,"percentile":0.91438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2023-03-06T13:34:04Z","modified":"2026-06-17T05:20:36Z","exploits":[{"source":"nuclei","id":"CVE-2022-4328","title":"WooCommerce Checkout Field Manager \u003c 18.0 - Arbitrary File Upload","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4328.yaml"}],"products":[{"vendor":"najeebmedia","product":"woocommerce_checkout_field_manager"},{"vendor":"unknown","product":"woocommerce checkout field manager"}],"references":[{"url":"https://wpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4328"},{"url":"https://github.com/advisories/GHSA-mqr5-jg85-4hvx"}],"sources":{"cve":[{"id":"CVE-2022-4328","title":"WooCommerce Checkout Field Manager \u003c 18.0 - Unauthenticated Arbitrary File Upload","description":"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server","status":"published","published":"2023-03-06T13:34:04.469Z","modified":"2025-03-04T19:24:32.711Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:37.932195Z"}],"euvd":[{"id":"EUVD-2022-51681","description":"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server","status":"published","published":"2023-03-06T13:34:04Z","modified":"2025-03-04T19:24:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:16.995722Z"}],"ghsa":[{"id":"GHSA-mqr5-jg85-4hvx","title":"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be...","description":"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server","status":"published","published":"2023-03-06T15:30:43Z","modified":"2023-03-19T05:03:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:54:21.862765Z"}],"nvd":[{"id":"CVE-2022-4328","description":"The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server","status":"published","published":"2023-03-06T14:15:09.723Z","modified":"2026-06-17T05:20:36.463Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:36.601381Z"}]}}