CVE-2022-4047 - Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

Back Back to CVE browser

CRITICAL

Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

Published Dec 26, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 6.15%

Description

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE

Affected products

Vendor n/a Product Return Refund and Exchange For WooCommerce Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.0.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Return Refund and Exchange For WooCommerce

unaffected

Version	Status	Constraints
0	affected	<4.0.9

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://wpscan.com/vulnerability/8965a87c-5fe5-4b39-88f3-e00966ca1d94
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/8965a87c-5fe5-4b39-88f3-e00966ca1d94		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Dec 26, 2022

Updated Apr 14, 2025

Reserved Nov 17, 2022

Link CVE-2022-4047

CISA Vulnrichment

Updated Apr 14, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4047

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-4047