CVE-2023-5953
Severity CVSS v4.0:
Pending analysis
Type:
CWE-434
Unrestricted Upload of File with Dangerous Type
Publication date:
04/12/2023
Last modified:
29/05/2025
Description
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:* | 2.9.5 (excluding) |
To consult the complete list of CPE names with products and versions, see this page