CVE-2022-4140

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

Input validation

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

Design/Logic Flaw

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in fileexist functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a...

Input validation

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

CVE-2022-4237 Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in fileexist functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a...

CVE-2022-4237

The CVE-2022-4237 issue affects the Welcart e-Commerce WordPress plugin up to version 2.8.6. The vulnerability arises because the plugin does not validate user input before using it in file_exist() functions via various AJAX actions accessible to authenticated users, enabling PHAR deserialisation...

CVE-2022-4237 Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in fileexist functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a...

CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4236

Vulnerability summary (CVE-2022-4236): Welcart e-Commerce WordPress plugin versions before 2.8.5 fail to validate input used to output file content via an AJAX action accessible to authenticated users, enabling at least subscriber-level users to read arbitrary server files. Root cause: unvalidate...

CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

CVE-2022-4140

The CVE-2022-4140 entry concerns the WordPress plugin Welcart e-Commerce before 2.8.5. The vulnerability arises because the plugin does not validate user input before using it to output the contents of a file, enabling unauthenticated attackers to read arbitrary server files. Several connected so...

CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

WordPress plugin Welcart e-Commerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2022-4237: Undefined Security Weakness

The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in fileexist functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a...

PT-2023-7910 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue is related to the use of files and directories accessible to external parties. It does not validate user input before using it to output the content of a file,...

WordPress plugin Welcart e-Commerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2023-14111 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.6 Description: The issue arises from the lack of validation of user input before using it in file exist functions via various AJAX actions available to any authenticated users. This...

CVE-2022-4236: Files or Directories Accessible to External Parties

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4140: Undefined Security Weakness

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...