CVE-2022-1574
Assigner: WPScan
Published: 2022-06-27T08:57:00
State: PUBLISHED
title: HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload
problemTypes: descriptions: description: CWE-862 Missing Authorization
type: CWE
descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
affected: vendor: Unknown
product: HTML2WP
versions: status: affected
versionType: custom
version: 0
lessThanOrEqual: 1.0.0
defaultStatus: affected
collectionURL: https://wordpress.org/plugins
descriptions: value: The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
credits: value: Daniel Ruf
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator