Role Based Pricing for WooCommerce <= 1.6.2 - Missing Authorization to PHAR Deserialization
critical
The Role Based Pricing for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass in versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access or higher, to perform PHAR deserialization attacks provided they can upload a file and a suitable po...
- CVSS:
- 9.8
- Affected:
- up to 1.6.2
- Fixed in:
- 1.6.3
- Disclosed:
- Oct 17, 2022
CVE-2022-3536 on NVD →
Role Based Pricing for WooCommerce <= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload
high
The Role Based Pricing for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation, and insufficient authorization in versions up to, and including, 1.6.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to upload arbi...
- CVSS:
- 8.8
- Affected:
- up to 1.6.1
- Fixed in:
- 1.6.2
- Disclosed:
- Oct 17, 2022
CVE-2022-3537 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database