WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload
CVE-2022-38140

7.6HIGH

Key Information:

Vendor: Wordpress
Status: Seo Plugin By Squirrly Seo (WordPress Plugin)
Vendor: CVE Published:; 28 November 2022

Summary

Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.

Affected Version(s)

SEO Plugin by Squirrly SEO (WordPress plugin) <= 12.1.10

References

https://patchstack.com/database/vulnerability/squirrly-se...

CVSS V3.1

Score:

7.6

Severity:

HIGH

Confidentiality:

Low

Integrity:

High

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Nov 28, 2022
Vulnerability Reserved
Sep 8, 2022

Credit

Yeraisci (Patchstack Alliance)

.