CVE-2022-4298

The CVE-2022-4298 issue affects the Wholesale Market WordPress plugin prior to version 2.2.1. The root cause is missing authorization checks and lack of validation for user input used to generate system paths, enabling unauthenticated attackers to download arbitrary files from the server (e.g., s...

CVE-2022-4363

CVE-2022-4363 affects WordPress plugins: Wholesale Market (pre-2.2.2) and Wholesale Market for WooCommerce (pre-2.0.1). A flawed CSRF check when updating settings could allow a logged-in admin to update settings via CSRF. Public details confirm the affected versions and the vulnerability class; n...