What’s Vulnerable › Vulnerabilities

CVE-2023-5957: Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-08 · updated 2026-06-17
• Weakness: CWE-434

Description

The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.

Affected products

• Ni Purchase Order(PO) For WooCommerce: through 1.2.1

References

• https://wpscan.com/vulnerability/70f823ff-64ad-4f05-9eb3-b69b3b79dc12
• https://wpscan.com/vulnerability/70f823ff-64ad-4f05-9eb3-b69b3b79dc12

Get alerted when CVE-2023-5957 or the next vulnerability affects your stack