CVE-2022-50972

CriticalCVSS 9.8/10Last modified Oct 6, 2026

Description

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2022

CVE-2022-509739.8Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unaut CVE-2022-509758.8An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configura CVE-2022-509767.7A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.CVE-2022-509777.5An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.CVE-2022-509787.5An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP)CVE-2022-509796.5An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS CVE-2022-509806.5A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.CVE-2022-509819.8An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and settin CVE-2022-509927.5Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-CVE-2022-509939.8Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.CVE-2022-509948.1DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows una CVE-2022-509977.5Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenti