cleantalk
Vulnerabilities and Security Researches

WooCommerce, CVE-2022-50972

CVE, Research URL

CVE-2022-50972

Home page URL

Security reports for WooCommerce

Application

WooCommerce

Published on
Jun 20, 2026
Research Description
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.
Affected versions
max 7.1.0.
Status
vulnerable
Previous vulnerability researches
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (bc1806a73d52da416d296180a8da4bf979fefb71) , Jun 16, 2026
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (ac7b051ed78b5cf1e4407d9f5099adcfe7c193b2) , Jun 16, 2026
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (213ad777f574b5d7172e7bacd1ae7aae65344485) , Jun 16, 2026
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (6126f80d6fcc17f2080b49119a502e1ea9dfbd45) , Jun 16, 2026
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2015-5532) , Jun 06, 2024
New vulnerability
WooCommerce (CVE-2022-50972) , Jun 22, 2026
Simple File List (CVE-2026-11911) , Jun 21, 2026
Simple File List (CVE-2026-12119) , Jun 21, 2026
Simple File List (CVE-2026-11912) , Jun 21, 2026
WP Hotel Booking (CVE-2026-9822) , Jun 21, 2026