WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
CVE-2022-2557

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Team – WordPress Team Members Showcase Plugin
Vendor
CVE Published:
22 August 2022

Summary

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user

Affected Version(s)

Team – WordPress Team Members Showcase Plugin 4.1.2

References

https://wpscan.com/vulnerability/c043916a-92c9-4d02-8cca-...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nhật Nam
.