WooCommerce Checkout Field Manager <= 17.3 - Unauthenticated Arbitrary File Upload
criticalThe WooCommerce Checkout Field Manager plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the cfom_upload_file function in versions up to, and including, 17.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv...
- CVSS:
- 9.8
- Affected:
- up to 17.3
- Fixed in:
- 18.0
- Disclosed:
- Feb 13, 2023