CVE-2022-2638CWE-73

Export All URLs < 4.4 - Admin+ Arbitrary System File Removal

published August 29, 2022

CVSS
—
EPSS
1%
Percentile
67.0
In the wild
Unconfirmed
What it is

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01165 · 67.0th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2022-08-29T17:15Z
EPSS history
Timeline
  • 29 AUG 17:15Z
    Export All URLs < 4.4 - Admin+ Arbitrary System File Removal
    cvelistv5