WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion
CVE-2022-46850

8.7HIGH

Key Information:

Vendor

WordPress
Status
Easy Media Replace
Vendor
CVE Published:
19 June 2023

What is CVE-2022-46850?

The Easy Media Replace plugin by Nabil Lemsieh has a vulnerability that allows authenticated users with author-level privileges to perform arbitrary file deletion. This vulnerability can lead to unauthorized manipulation of files within the WordPress installation, posing a risk to site integrity and data security, particularly for sites utilizing this plugin version 0.1.3 or earlier.

Affected Version(s)

Easy Media Replace <= 0.1.3

References

https://patchstack.com/database/vulnerability/easy-media-...
vdb-entry

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeong Seong Ho (Patchstack Alliance)
.