High severity · published Mar 21, 2022
CVE-2022-0687
Amelia < 1.0.46 - Manager+ RCE
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Amelia – Events & Appointments Booking Calendar ·
1.0.47 before 1.0.47 · source: vendor
AM
Amelia · Tms-outsource
before 1.0.47 · source: NVD
Affected product
AE
Amelia – Events & Appointments Booking Calendar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0687
Exploit
https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c
More from Amelia – Events & Appointments Booking Calendar
6.1
CVE-2022-0627
Amelia < 1.0.46 - Reflected Cross-Site Scripting
5.4
CVE-2022-0825
Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
5.4
CVE-2022-0720
Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
4.3
CVE-2022-0616
Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF