by Kastro
Paper/Archive/CVE-2022-4298

CVE-2022-4298

Unknown Wholesale Market — Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.1.791 × 2015.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.

Affected

ProductAffectedFixed inSource
Wholesale Market< 2.2.12.2.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478