CVE-2022-3921

Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

CVSS 9.8 CRITICALEPSS 21.2%

Vexday Risk Score

53Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 21.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

12 Dec 2022Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unknown · Listingo

public PoCs found — 1

cve_referencewpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14funverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f