Lucene search

PRIOn knowledge basePRION:CVE-2022-4108

HistoryDec 19, 2022 - 2:15 p.m.

Code injection

2022-12-1914:15:00

PRIOn knowledge base

www.prio-n.com

code injection

woocommerce

wordpress

plugin

validation

user input

system path

high privilege users

admin

arbitrary file

server

multisite

nvd

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.8%

JSON

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)

CPENameOperatorVersion
wholesale_market_for_woocommercelt1.0.8

CPE	Name	Operator	Version
	wholesale_market_for_woocommerce	lt	1.0.8

References

wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470