Lucene search

CVE-2022-4106

🗓️ 19 Dec 2022 14:12:15Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 allows unauthenticated attackers to download arbitrary files

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 6
Prion	Design/Logic Flaw	19 Dec 202214:15	–	prion
Vulnrichment	CVE-2022-4106 Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download	19 Dec 202213:41	–	vulnrichment
WPVulnDB	Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download	28 Nov 202200:00	–	wpvulndb
Cvelist	CVE-2022-4106 Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download	19 Dec 202213:41	–	cvelist
NVD	CVE-2022-4106	19 Dec 202214:15	–	nvd
wpexploit	Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download	28 Nov 202200:00	–	wpexploit

Nvd

Vulners

Node

cedcommerce wholesale_market_for_woocommerceRange<1.0.7wordpress

[
  {
    "vendor": "Unknown",
    "product": "Wholesale Market for WooCommerce",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.0.7"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee-7332890804ed

Parameter	Position	Path	Description	CWE
action	query param	/wp-admin/admin-post.php	Unauthenticated file download vulnerability allowing attackers to download arbitrary files from the server.	CWE-552
tab	query param	/wp-admin/admin-post.php	Unauthenticated file download vulnerability allowing attackers to download arbitrary files from the server.	CWE-552
section	query param	/wp-admin/admin-post.php	Unauthenticated file download vulnerability allowing attackers to download arbitrary files from the server.	CWE-552
ced_cwsm_log_download	query param	/wp-admin/admin-post.php	Unauthenticated file download vulnerability allowing attackers to download arbitrary files from the server.	CWE-552
action	query param	/wp-admin/admin-ajax.php	File inclusion vulnerability allowing unauthenticated users to download sensitive files (like wp-config.php) from the server.	CWE-552
ced_cwsm_log_download	query param	/wp-admin/admin-ajax.php	File inclusion vulnerability allowing unauthenticated users to download sensitive files (like wp-config.php) from the server.	CWE-552

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

19 Dec 2022 14:15Current

7.7High risk

Vulners AI Score7.7

CVSS37.5

EPSS0.0045

SSVC

CWE-552