CVEs-PoC/2023/CVE-2023-6979.md

CVE-2023-6979

Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

POC

Reference

No PoCs from references.

Github

• https://github.com/20142995/nuclei-templates