CVE-2023-5953

Severity CVSS v4.0:
Pending analysis
Type:
CWE-434 Unrestricted Upload of File with Dangerous Type
Publication date:
04/12/2023
Last modified:
29/05/2025

Description

The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:* 2.9.5 (excluding)