payever WooCommerce Gateway unauthenticated file upload leads to remote code execution
Anyone can upload files to a payment plugin and hack your site!
Summary
The payever WooCommerce Gateway plugin (up to and including 4.8.0) lets unauthenticated attackers upload files and run code on the server. WordPress stores using this plugin are affected.
What to do
Check that the plugin runs a version newer than 4.8.0 and read the vendor's advisory. The sources do not name a fixed version.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen