9.8
Critical
CVE-2023-5601 The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded,…
Description
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WooCommerce Ninja Forms Product Add-ons 1.7 | earliest → < 1.7.1 | 1.7.1 |