CVE-2022-0316
Critical
Description
The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAidreform
PublishedJan 23, 2023
First seenJan 23, 2023
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- chimpgroup westand2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aidreform_project aidreform | No range specified | — |
| chimpgroup bolster | No range specified | — |
| chimpgroup spikes | No range specified | — |
| chimpgroup westand | v < 2.1 | 2.1 |
| club-theme_project club-theme | No range specified | — |
| footysquare_project footysquare | No range specified | — |
| pixfill kings_club | No range specified | — |
| soundblast_project soundblast | No range specified | — |
| spikes-black_project spikes-black | No range specified | — |
| statfort_project statfort | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.