CVE-2022-2222CWE-552

Download Monitor < 4.5.91 - Admin+ Arbitrary File Download

published July 17, 2022

CVSS
—
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01132 · 66.2th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2022-07-17T10:37Z
EPSS history
Timeline
  • 17 JUL 10:37Z
    Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
    cvelistv5