CVE-2022-4395: Wpswings Membership For Woocommerce

Critical severity, CVSS 9.8. EPSS: 17.6% chance of exploitation in the next 30 days.

The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.

Affected products

• Wpswings Membership For Woocommerce: before 2.1.7 (fixed in 2.1.7)

Published 2023-01-30. Last modified 2026-06-17.