CVE-2022-4237

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
UnknownWelcart e-Commerce< 2.8.6

References

Timeline

Published
Jan 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-423707.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423717.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423727.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423737.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423747.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423755.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiCVE-2022-423765.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interactiCVE-2022-423777.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423787.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423797.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423807.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is reCVE-2022-423817.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is re
CVE-2022-4237: High severity, CVSS 8.8 | Vulnix