CVE-2023-5957 is a high severity (CVSS 7.2 in the record) unrestricted file upload flaw in the Ni Purchase Order(PO) For WooCommerce plugin, through version 1.2.1. A privileged user can upload arbitrary files through the logo and signature settings. WPScan reports a fix in 1.2.2. WPScan scores it 6.6 Medium.
What's affected
- Plugin: Ni Purchase Order(PO) For WooCommerce, by Nazi Infotech.
- Affected: all versions through 1.2.1.
- Fixed: 1.2.2, per WPScan.
- Severity: 7.2 High in the NVD record. WPScan scores it 6.6 Medium. The two sources differ by a small amount.
- Privilege needed: a high privileged account that can open the plugin settings page, such as an administrator.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Ni Purchase Order(PO) For WooCommerce. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Ni Purchase Order(PO) For WooCommerce and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is ni-purchase-orderpo-for-woocommerce.
A version at or below 1.2.1 is affected. You can also browse the plugin's upload folder under wp-content/uploads for files that are not images, such as anything ending in .php.
What to do now
- Update the plugin to 1.2.2 or later, or remove it if you no longer issue purchase orders through it.
- Look in the plugin's upload folder for files that are not images, and investigate any you find.
- Review the list of administrator accounts and remove any you do not recognize.
- Turn off PHP execution in the uploads directory at the web server level, so an uploaded script cannot run even if one gets through.
- Rotate credentials for administrators if you find unexplained files.
Why it matters
The plugin accepts files in its settings for a company logo and signature, but does not check that they are images. That is CWE-434, unrestricted upload of a file with a dangerous type. If a script lands in a web accessible folder and the server runs it, the upload becomes remote code execution.
The need for a high privilege account is a real limit. An administrator can usually install plugins and run code anyway, so the added power is small on a site with one trusted admin. The risk grows where shop managers or vendors have access to settings, where admin accounts get phished, or where a different bug hands out those rights. Blocking script execution in uploads is a cheap defense that removes this whole class of problem. The record does not list this CVE as known exploited.
Quick check
If only administrators can use it, is it worth fixing?
Yes, because it takes little effort and administrator accounts do get stolen. A flaw that turns a stolen admin login into code on the server is worth closing.
Sources
Last reviewed: 19 October 2026.
