CVE-2022-3912

PoC —

CVSS 3.1

7.5 high

EPSS

<1%p53

Published

Dec 12, 2022 (Dec 12, 2022)

Modified

Jun 17, 2026

Description

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.

Vendors: wpeverest
Products: user registration
Ecosystems: WordPress
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.