CVE-2022-4236
PoC —CVSS 3.1
6.5 medium
EPSS
<1%p54
Published
()
Modified
Description
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Vendors
- welcart
- Products
- welcart e-commerce
- Ecosystems
- WordPress
- Weakness
- CWE-552
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
In the news0 stories
No ingested article mentions this CVE yet.