WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php
Vulnerability Description
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-50972
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Milad Karimi
References
More from WooCommerce
View All →Affected Vendor
WooCommerce
View all reports →