CVE-2022-2981CWE-552

Download Monitor < 4.5.98 - Admin+ Arbitrary File Download

published October 10, 2022

CVSS
—
EPSS
1%
Percentile
65.3
In the wild
Unconfirmed
What it is

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01097 · 65.3th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2022-10-10T00:00Z
EPSS history
Timeline
  • 10 OCT 00:00Z
    Download Monitor < 4.5.98 - Admin+ Arbitrary File Download
    cvelistv5