WPtouch < 4.3.45 - Admin+ Arbitrary File Upload
CVE-2022-3416
Key Information:
Badges
Summary
The WPtouch plugin for WordPress, prior to version 4.3.45, is susceptible to an arbitrary file upload vulnerability due to improper validation of uploaded images. This issue enables high privilege users, such as administrators, to upload arbitrary files to the server, circumventing intended restrictions, particularly in multisite setups where such actions should be prohibited. This poses a significant security risk as it could potentially allow attackers to execute malicious files on vulnerable installations.
Affected Version(s)
WPtouch 0 < 4.3.45
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
12% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved