Vulnerability Description
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mappresspro | Mappress | < 2.73.13 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367ExploitThird Party Advisory
- https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367ExploitThird Party Advisory
FAQ
What is CVE-2022-0537?
CVE-2022-0537 is a vulnerability with a CVSS score of 7.2 (HIGH). The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the ...
How severe is CVE-2022-0537?
CVE-2022-0537 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-0537?
Check the references section above for vendor advisories and patch information. Affected products include: Mappresspro Mappress.