NVD CRITICAL: CVE-2022-50972 — WooCommerce 7.1.0 contains a remote code execution vulnerability that allows att...

Saturday, June 20, 2026 at 02:16 PM UTC·Source: NIST NVD

Updated: Saturday, June 20, 2026 at 03:02 PM UTC

Executive Summary

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2022-50972

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jun 20, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-58289 — Access of resource using incompatible type ('type confusion') in Microsoft Edge ...

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-58289

1d agoNIST NVD

MEDIUMVulnerability

Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices

Security firm runZero has disclosed seven vulnerabilities in FatFs, a small filesystem library that lets a device read and write the FAT and exFAT formats used on USB drives and SD cards. The flaws matter because FatFs is nearly everywhere. It ships inside the firmware that runs security cameras, drones, industrial controllers, hardware crypto wallets, and other devices built on

1d agoThe Hacker News

MEDIUMVulnerability

NetNut proxy network disrupted, 2 million infected devices cut off

A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes. [...]

1d agoBleepingComputer