CVE-2022-2981

PoC —

CVSS 3.1

4.9 medium

EPSS

<1%p60

Published

Oct 10, 2022 (Oct 10, 2022)

Modified

Jun 17, 2026

Description

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Vendors: wpchill
Products: download monitor
Ecosystems: WordPress
Weakness: CWE-552
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.