Threats tagged 'ghsa-5w75-33gq-gccg'

The payever WooCommerce Gateway plugin for WordPress versions up to and including 4.8.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload executable PHP files, leading to remote code execution. This is due to three WooCommerce-API callbacks lacking authentication and capability checks, combined with an insecure file upload routine that writes attacker-controlled files before validating their type. Additionally, an unauthenticated hard-coded credential identity overwrite issue exists independently.