CVE-2022-2554 Enable Media Replace < 4.0.0 - Admin+ Path Traversal

2022-10-1000:00:00

CWE-22

WPScan

www.cve.org

wordpress

plugin

path traversal

0.001 Low

EPSS

Percentile

25.9%

JSON

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Enable Media Replace",
    "versions": [
      {
        "version": "4.0.0",
        "status": "affected",
        "lessThan": "4.0.0",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/5872f4bf-f423-4ace-b8b6-d4cc4f6ca8d9

0.001 Low

EPSS

Percentile

25.9%

JSON

Related for CVELIST:CVE-2022-2554