CVE-2022-1953

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19545.3A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.CVE-2022-19554.6Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user d CVE-2022-19564.3The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul CVE-2022-19574.3The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-19586.5A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manip CVE-2022-19596.6AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because th CVE-2022-19604.3The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l CVE-2022-19614.8The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4 CVE-2022-19625.5Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack e CVE-2022-19635.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 befor CVE-2022-19645.4The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Autho CVE-2022-19658.1Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly