CVE-2022-0537: fallo en MapPress Maps for WordPress
MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution
Publicada el · Actualizada el
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 1.5%
probabilidad de explotación
1.5%top 26% de las CVE
explotación observada
noninguna fuente lo reporta
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Productos afectados
Unknown · MapPress Maps for WordPressCVEs relacionadas — MapPress Maps for WordPress
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-0208—MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scriptingEPSS 2.0%CVE-2024-0421MEDIUMMapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post DisclosureEPSS 0.6%CVE-2025-2055MEDIUMMapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSSEPSS 0.5%CVE-2024-0420MEDIUMMapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSSEPSS 0.5%CVE-2025-2162MEDIUMMapPress Maps for WordPress < 2.94.10 - Admin+ Stored XSSEPSS 0.4%CVE-2024-8620MEDIUMMapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map SettingsEPSS 0.3%