What’s Vulnerable › Vulnerabilities

CVE-2022-1574: HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-27 · updated 2026-06-17
• Weakness: CWE-352

Description

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server

Affected products

• HTML2WP: through 1.0.0

References

• https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14
• https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14

Get alerted when CVE-2022-1574 or the next vulnerability affects your stack