CVE-2022-0779CWE-22

User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal

published June 6, 2022

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02324 · 83.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-06-06T08:50Z
EPSS history
Timeline
  • 06 JUN 08:50Z
    User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal
    cvelistv5