CVE-2022-4328
Published: 06 March 2023
Summary
CVE-2022-4328 is a critical-severity an unspecified weakness vulnerability in Najeebmedia Woocommerce Checkout Field Manager. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2022-4328 affects the WooCommerce Checkout Field Manager WordPress plugin prior to version 18.0. It stems from missing validation on files uploaded through the plugin, enabling arbitrary file uploads including executable PHP scripts directly onto the server.
Unauthenticated remote attackers can exploit the flaw over the network without any credentials or user interaction. Successful exploitation grants full control over the affected site, allowing arbitrary code execution that can result in complete confidentiality, integrity, and availability compromise as reflected in the CVSS 9.8 score.
The referenced WPScan advisory identifies the issue in versions before 18.0 and points to an update to that release or later as the corrective action.
EPSS for the CVE rose from lower values to a peak of 0.8296 on 2025-12-11 before receding to the current 0.6927, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51681
Vulnerability details
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.