CVE-2022-2557CWE-22

WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

published August 22, 2022

CVSS
—
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01647 · 76.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-08-22T15:04Z
EPSS history
Timeline
  • 22 AUG 15:04Z
    WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
    cvelistv5