CVE-2023-52221: Critical File Upload Flaw in Barcode Scanner Plugin

CVE-2023-52221 is a critical severity (10.0) unrestricted file upload in the Barcode Scanner and Inventory Manager WordPress plugin, affecting version 1.5.1 and earlier. The developer fixed it in version 1.5.2. Update the plugin to 1.5.2 or later, and if you cannot update, deactivate it until you can.

What's affected

The NVD record names UkrSolution and the Barcode Scanner and Inventory Manager plugin for WordPress, from the earliest release through 1.5.1. Patchstack lists 1.5.2 as the patched version. Upgrade to 1.5.2 or any later release.

The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which gives 10.0 (Critical).

Patchstack lists the required privilege as unauthenticated. No login is needed. This is the same plugin and the same fixed version as CVE-2023-52215, so one update closes both.

How to check if you're exposed

Start with the plugin list. On a server with WP-CLI, run this from the site folder:

wp plugin list
wp plugin get barcode-scanner-lite-pos-to-manage-products-inventory-and-orders

The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.

Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.

A version at or below 1.5.1 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.

What to do now

1. Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
2. Update Barcode Scanner and Inventory Manager to 1.5.2 or later on staging first if you test changes, then on production.
3. If the update cannot go out today, deactivate the plugin. A deactivated plugin does not run its code.
4. Review recent activity: look in the uploads and plugin folders for files you did not put there, particularly PHP files, and check for new administrator accounts.
5. Add the plugin to whatever tracks your WordPress inventory, so the next advisory finds it quickly.

Why it matters

Unrestricted file upload means the plugin accepts a file from the requester without limiting its type or checking what it contains. On a PHP site, a file of the wrong type stored in a web accessible folder can end up being run as code by the web server.

Patchstack lists the privilege required as unauthenticated, so no account is needed. A file upload bug that needs no login is among the most valuable for attackers, which explains the top score of 10.0. If you ran an affected version on a public site, check for unexpected files as well as updating. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.

Quick check

Sources

• Patchstack database entry
• Gold page for CVE-2023-52221

Last reviewed: 19 October 2026.