CVE-2022-4108

Published: Dec 19, 2022Modified: Apr 14, 2025

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)

Affected (1)

Products: Cedcommerce: Wholesale Market For Woocommerce

Cedcommerce

1 product

Wholesale Market For Woocommerce

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cedcommerce Wholesale Market For Woocommerce	Before 1.0.8

References (2)

https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.