CVE-2024-3962: Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
themeisle · PPOM – Product Addons & Custom Fields for WooCommerce
Affected: themeisle PPOM – Product Addons & Custom Fields for WooCommerce · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 72% of scored CVEs
DescriptionCVE.org
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- themeisle · PPOM – Product Addons & Custom Fields for WooCommerceup to and including 32.0.18
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- themeisle
- Published
- April 2024
CoverageNo articles yet
No CyberSIXT article names CVE-2024-3962 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.