CVSS v3
9.8
CRITICAL
EPSS Score
73.3%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
Active exploitation of CVE-2022-4047 has not been confirmed. The EPSS score is 73.3%, indicating the estimated probability of exploitation in the next 30 days.
CVE-2022-4047 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).