Cyber Resilience

CVE-2022-4328

CriticalPublic PoC

Published: 06 March 2023

Published
06 March 2023
Modified
04 March 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.6927 98.7th percentile
Risk Priority 61 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-4328 is a critical-severity an unspecified weakness vulnerability in Najeebmedia Woocommerce Checkout Field Manager. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability CVE-2022-4328 affects the WooCommerce Checkout Field Manager WordPress plugin prior to version 18.0. It stems from missing validation on files uploaded through the plugin, enabling arbitrary file uploads including executable PHP scripts directly onto the server.

Unauthenticated remote attackers can exploit the flaw over the network without any credentials or user interaction. Successful exploitation grants full control over the affected site, allowing arbitrary code execution that can result in complete confidentiality, integrity, and availability compromise as reflected in the CVSS 9.8 score.

The referenced WPScan advisory identifies the issue in versions before 18.0 and points to an update to that release or later as the corrective action.

EPSS for the CVE rose from lower values to a peak of 0.8296 on 2025-12-11 before receding to the current 0.6927, indicating emerging exploitation interest after disclosure.

EU & UK References

Vulnerability details

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

CWE(s)
None listed

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

najeebmedia
woocommerce checkout field manager
≤ 18.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References