CVE-2022-4237: Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-02 · updated 2026-06-17

Description

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog

Affected products

Welcart e-Commerce: before 2.8.6 — fixed in 2.8.6

How to fix

Upgrade to a fixed version: Welcart e-Commerce 2.8.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7a4b790c-49ae-46bc-9544-e188deae243f
https://wpscan.com/vulnerability/7a4b790c-49ae-46bc-9544-e188deae243f

Get alerted when CVE-2022-4237 or the next vulnerability affects your stack