Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation

CVE-2022-4237

Summary

The Welcart e-Commerce plugin for WordPress prior to version 2.8.6 contains an input validation flaw that allows authenticated users, even those with minimal permissions, to exploit AJAX actions that do not properly validate user input before executing file_exist() functions. This oversight can facilitate unauthorized PHAR deserialization if an attacker is able to upload a file and trigger the necessary conditions on a compromised blog.

References