CVE-2022-1103

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	Advanced uploader	>= 4.2, <= 4.2

References

https://wpscan.com/vulnerability/9ddeef95-7c7f-4296-a55b-fd3304c91c18Exploit, Third Party Advisory
https://wpscan.com/vulnerability/9ddeef95-7c7f-4296-a55b-fd3304c91c18Exploit, Third Party Advisory

Timeline

Published: May 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-11044.8The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege use CVE-2022-11054.3An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 p CVE-2022-11069.1use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-11076.7During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovere CVE-2022-11086.7A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be CVE-2022-11097.5An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service.CVE-2022-11105.5A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of ser CVE-2022-11112.7A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under CVE-2022-11125.4The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as CVE-2022-11134.8The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high pr CVE-2022-11147.1A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an at CVE-2022-11155.5A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered