WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload
CVE-2022-38140

7.6HIGH

Key Information:

Vendor

WordPress
Status
Seo Plugin By Squirrly Seo (WordPress Plugin)
Vendor
CVE Published:
28 November 2022

What is CVE-2022-38140?

Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.

Affected Version(s)

SEO Plugin by Squirrly SEO (WordPress plugin) <= 12.1.10

References

https://patchstack.com/database/vulnerability/squirrly-se...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yeraisci (Patchstack Alliance)
.