CVE-2022-2554CWE-22

Enable Media Replace < 4.0.0 - Admin+ Path Traversal

published October 10, 2022

CVSS
—
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00950 · 60.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-10-10T00:00Z
EPSS history
Timeline
  • 10 OCT 00:00Z
    Enable Media Replace < 4.0.0 - Admin+ Path Traversal
    cvelistv5