CVE-2022-4106
Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.5EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
19 Dec 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · Wholesale Market for WooCommerceWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →