CVE-2022-2222 - Download Monitor < 4.5.91 - Admin+ Arbitrary File Download

Back Back to CVE browser

MEDIUM

Download Monitor < 4.5.91 - Admin+ Arbitrary File Download

Published Jul 17, 2022

4.9

MEDIUM

CVSS 3.1

EPSS 1.13%

Description

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Affected products

Vendor n/a Product Download Monitor Default
n/a
- Version
  4.5.91
  Status
  affected
  Constraints
  <4.5.91

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Download Monitor

n/a

Version	Status	Constraints
4.5.91	affected	<4.5.91

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-552

References (1)

https://wpscan.com/vulnerability/dd48624a-1781-419c-a3c4-1e3eaf5e2c1b
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/dd48624a-1781-419c-a3c4-1e3eaf5e2c1b		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jul 17, 2022

Updated Aug 3, 2024

Reserved Jun 27, 2022

Link CVE-2022-2222

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-2222

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-2222