CVE-2022-3912 — User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated …
Published: 2022-12-12 · CVSS: 7.5 · CVSS 3.1
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7