Critical severity9.8NVD Advisory· Published Jan 30, 2023· Updated Jun 17, 2026

CVE-2022-4395

Description

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpswings/Membership For Woocommerce
cpe:2.3:a:wpswings:membership_for_woocommerce:*:*:*:*:*:wordpress:*:*
Range: <2.1.7
WordPress/Membership For Woocommercecpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.1.7
Package: https://wordpress.org/plugins/membership-for-woocommerce

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/80407ac4-8ce3-4df7-9c41-007b69045c40nvdExploitThird Party Advisory
packetstormsecurity.com/files/177934/WordPress-Membership-For-WooCommerce-Shell-Upload.htmlnvd
www.exploit-db.com/exploits/51959nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.014
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000