CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It affects WordPress. Its EPSS score suggests a 11.9% probability of exploitation in the next 30 days. It may be remotely exploitable. Exploitation may require the attacker to be authenticated.
CVE
CVE-2022-1574
Severity
CRITICAL
CVSS
9.8
EPSS
11.87%
WordPress
Original NVD Description
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
Related CVEs
Other vulnerabilities affecting the same vendor(s)