CVE-2022-3912

7.5 highEPSS 0.8%

High (7.5) in wpeverest user registration. EPSS 0.8% chance of exploitation in the next 30 days.

The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2022-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wpeverest:user_registration

References

https://wpscan.com/vulnerability/968c677c-1beb-459b-8fd1-7f70bcaa4f74
https://wpscan.com/vulnerability/968c677c-1beb-459b-8fd1-7f70bcaa4f74

Check your stack JSON