CVE-2022-36285 - WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

HIGH

WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability

Published Aug 23, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.18%

Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
<= 1.0.1	affected	<=1.0.1

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39002		Advisory
https://patchstack.com/database/vulnerability/uploading-svgwebp-and-ico-files/wordpress-uploading-svg-webp-and-ico-files-plugin-1-0-0-authenticated-arbitrary-file-upload-vulnerability		x_refsource_CONFIRMThird Party Advisory
https://wordpress.org/plugins/uploading-svgwebp-and-ico-files/#developers		x_refsource_CONFIRMProductRelease Notes