Lucene search
Daniel RufWPEX-ID:FEB4580D-DF15-45C8-B59E-AD406E4B064CHistoryJan 04, 2023 - 12:00 a.m.
AAWP < 3.12.3 - Unsafe URL Handling
2023-01-0400:00:00
Daniel Ruf
78
aawp
url handling
security exploit
file download
EPSS
0.002
Percentile
58.9%
The plugin can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
wp-content/aawp/public/image.php?url=[base64-url] will load and download the file from the base64-decoded URLRelated
prion
prion
Design/Logic Flaw
2023-01-30 21:15:00
cvelist
cvelist
CVE-2022-4794 AAWP < 3.12.3 - Unsafe URL Handling
2023-01-30 20:31:32
cve
cve
CVE-2022-4794
2023-01-30 21:15:12
wpvulndb
wpvulndb
AAWP < 3.12.3 - Unsafe URL Handling
2023-01-04 00:00:00
nvd
nvd
CVE-2022-4794
2023-01-30 21:15:12