CVE-2022-4774

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-477409.8Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.CVE-2022-477458.8ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a s CVE-2022-477477.5kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.CVE-2022-47755.4The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-477579.8In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into CVE-2022-477589.8Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.CVE-2022-47765.4The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2022-477627.5In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.CVE-2022-477668.8PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.CVE-2022-477679.8A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This af CVE-2022-477687.5Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.CVE-2022-477699.8An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious file