9.8

CVE-2022-0316

Exploit

Multiple themes - Unauthenticated Arbitrary File Upload

Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload

The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
Mögliche Gegenmaßnahme
Aidreform: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Bolster: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Club Theme: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Footysquare: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Kingclub Theme: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Soundblast: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Spikes: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Spikes Black: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Statfort: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Westand: Update to version 2.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aidreform Project ≫ Aidreform Version- SwPlatformwordpress
Chimpgroup ≫ Bolster Version- SwPlatformwordpress
Chimpgroup ≫ Spikes Version- SwPlatformwordpress
Chimpgroup ≫ Westand SwPlatformwordpress Version < 2.1
Club-theme Project ≫ Club-theme Version- SwPlatformwordpress
Footysquare Project ≫ Footysquare Version- SwPlatformwordpress
Pixfill ≫ Kings Club Version- SwPlatformwordpress
Soundblast Project ≫ Soundblast Version- SwPlatformwordpress
Spikes-black Project ≫ Spikes-black Version- SwPlatformwordpress
Statfort Project ≫ Statfort Version- SwPlatformwordpress
Weitere Schwachstelleninformationen
SystemWordPress Theme
≫
Produkt Aidreform
Version *
SystemWordPress Theme
≫
Produkt Bolster
Version *
SystemWordPress Theme
≫
Produkt Club Theme
Version *
SystemWordPress Theme
≫
Produkt Footysquare
Version *
SystemWordPress Theme
≫
Produkt Kingclub Theme
Version *
SystemWordPress Theme
≫
Produkt Soundblast
Version *
SystemWordPress Theme
≫
Produkt Spikes
Version *
SystemWordPress Theme
≫
Produkt Spikes Black
Version *
SystemWordPress Theme
≫
Produkt Statfort
Version *
SystemWordPress Theme
≫
Produkt Westand
Version [*, 2.1)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.08% 0.791
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3c45ac-44c0-47e1-81af-65014f064513
Third Party Advisory