Veeqo For Woocommerce
Monthly
Authenticated users holding only Subscriber-level access can abuse the Veeqo for WooCommerce WordPress plugin (all versions through 2.2.8) to make the site download and extract an attacker-controlled archive, dropping arbitrary PHP files into the WordPress root and converting a low-privilege account into remote code execution; publicly available exploit code exists. The plugin's remote bridge-installation routine performs neither a capability check nor any validation of the URL it is given, and the attack needs no user interaction - the practical gate is simply having an account on the target site (e.g. open self-service registration) and the plugin being installed and active. Note that the widely published CVSS 4.3 score reflects confidentiality-only impact and understates the flaw; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CISA's SSVC decision data records no observed exploitation and marks the issue non-automatable.
Authenticated users holding only Subscriber-level access can abuse the Veeqo for WooCommerce WordPress plugin (all versions through 2.2.8) to make the site download and extract an attacker-controlled archive, dropping arbitrary PHP files into the WordPress root and converting a low-privilege account into remote code execution; publicly available exploit code exists. The plugin's remote bridge-installation routine performs neither a capability check nor any validation of the URL it is given, and the attack needs no user interaction - the practical gate is simply having an account on the target site (e.g. open self-service registration) and the plugin being installed and active. Note that the widely published CVSS 4.3 score reflects confidentiality-only impact and understates the flaw; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CISA's SSVC decision data records no observed exploitation and marks the issue non-automatable.