CVE-2022-4298 - Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download

Back Back to CVE browser

CRITICAL

Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download

Published Jan 2, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.83%

Description

The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.

Affected products

Vendor n/a Product Wholesale Market Default
unaffected
Affected
- ≥ 0, < 2.2.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Wholesale Market	unaffected	Affected ≥ 0, < 2.2.1

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51654
Advisory
https://wpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51654		Advisory
https://wpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jan 2, 2023

Updated Apr 10, 2025

Reserved Dec 6, 2022

Link CVE-2022-4298

CISA Vulnrichment

Updated Apr 10, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4298

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Jan 2, 2023

Updated Apr 10, 2025

Link EUVD-2022-51654

GitHub

No data