CVE-2022-3982

EUVD-2022-43311
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
wpdevartbooking_calendar
𝑥
< 3.2.2
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867
https://wpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867