CVE-2022-4328: WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-06 · updated 2026-06-17

Description

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

Affected products

WooCommerce Checkout Field Manager: before 18.0 — fixed in 18.0

How to fix

Upgrade to a fixed version: WooCommerce Checkout Field Manager 18.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed
https://wpscan.com/vulnerability/4dc72cd2-81d7-4a66-86bd-c9cfaf690eed

Get alerted when CVE-2022-4328 or the next vulnerability affects your stack