CVE-2022-2554

PoC —

CVSS 3.1

4.9 medium

EPSS

<1%p56

Published

Oct 10, 2022 (Oct 10, 2022)

Modified

Jun 17, 2026

Description

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example

Vendors: shortpixel
Products: enable media replace
Ecosystems: WordPress
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.