WordPress Plugin Vulnerabilities

Uploading SVG, WEBP and ICO files <= 1.2.1 - Admin+ Arbitrary File Upload

Description

The plugin does not validate the files to be uploaded, which could allow high privilege users such as admin to upload arbitrary files, even when they are not supposed to

Affects Plugins

Plugin icon
uploading-svgwebp-and-ico-files
No known fix

References

CVE
CVE-2022-36285

Miscellaneous

Original Researcher
Kim Jong Min aka Universe
Verified
No
WPVDB ID
1e56e2b0-c494-4971-85e8-75c776db2797

Timeline

Publicly Published
2022-08-11 (about 3 years ago)
Added
2022-08-24 (about 3 years ago)
Last Updated
2023-05-16 (about 2 years ago)

Other

Published
Title
Published
2025-07-23
Title
WPBookit < 1.0.7 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
Published
2026-01-13
Title
Blogzee <= 1.0.5 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2013-01-04
Title
Eptonic - Valums Uploader Shell Upload Exploit
Published
2025-06-27
Title
File Manager Plugin For Wordpress <= 7.5 - Authenticated (Admin+) Arbitrary File Upload
Published
2023-12-12
Title
Greenshift – animation and page builder blocks < 7.6.3 - Authenticated (Administrator+) Arbitrary File Upload