PatchSiren cyber security CVE debrief
CVE-2022-50972 WooCommerce CVE debrief
CVE-2022-50972 is a critical remote code execution vulnerability in WooCommerce 7.1.0. The vulnerability allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. This is achieved by sending requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values, enabling the writing of malicious PHP files to the web root. The CVSS score for this vulnerability is 9.3, indicating a critical severity. Organizations using WooCommerce 7.1.0 should prioritize immediate remediation to prevent potential exploitation.
- Vendor
- WooCommerce
- Product
- Unknown
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-20
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-20
- Advisory updated
- 2026-06-22
Who should care
Administrators and security teams of e-commerce platforms using WooCommerce 7.1.0 should be aware of this vulnerability. Given the critical severity and potential for remote code execution, immediate attention is required to mitigate the risk of exploitation.
Technical summary
The vulnerability exists in WooCommerce 7.1.0, specifically in how it handles the product-type parameter. Unsanitized input allows attackers to inject shell commands, which can then be used to write malicious PHP files to the web root, enabling remote code execution. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, reflecting a critical severity with a score of 9.3.
Defensive priority
High priority due to critical severity and potential for remote code execution.
Recommended defensive actions
- Inventory WooCommerce installations to identify those running version 7.1.0.
- Review official advisories and documentation for remediation guidance.
- Apply vendor-supported remediation or patches as available.
- Implement compensating controls to limit exposure, such as restricting access to the affected endpoint.
- Monitor for suspicious activity related to the class-wc-meta-box-product-images.php endpoint.
- Track exceptions and anomalies in web application logs for potential exploitation attempts.
Evidence notes
The primary evidence for this vulnerability comes from the CVE record and NVD detail pages. The vulnerability affects WooCommerce version 7.1.0. Evidence limits suggest that specific details about exploitation are not widely available, emphasizing the need to verify information from official sources like CVE.org and NVD.
Official resources
This article is AI-assisted and based on the supplied source corpus.