Arbitrary File Upload Vulnerability in Customer Reviews Plugin for WordPress by WooCommerce
CVE-2023-6979

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Customer Reviews for WooCommerce
Vendor
CVE Published:
11 January 2024

What is CVE-2023-6979?

The Customer Reviews for WooCommerce plugin for WordPress is susceptible to an arbitrary file upload vulnerability. This arises from inadequate file type validation within the ivole_import_upload_csv AJAX action in all versions up to and including 5.38.9. As a result, authenticated attackers with author-level access can upload malicious files to the server hosting the affected site, potentially leading to remote code execution. This vulnerability can expose the site to various security threats, making it crucial for site administrators to apply the necessary patches to safeguard against exploitation.

Affected Version(s)

Customer Reviews for WooCommerce * <= 5.38.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/customer-revie...
https://drive.proton.me/urls/K4R2HDQBS0#iuTPm3NqZEdz

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Artem Guzhva
.