CVE-2022-4108: Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download
The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the Wholesale Market for WooCommerce WordPress plugin?
The vulnerability ID for the Wholesale Market for WooCommerce WordPress plugin is CVE-2022-4108.
What is the title of the vulnerability?
The title of the vulnerability is 'The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used…'
What is the severity of CVE-2022-4108?
The severity of CVE-2022-4108 is medium.
How does CVE-2022-4108 affect the Wholesale Market for WooCommerce WordPress plugin?
CVE-2022-4108 allows high privilege users such as admin to download arbitrary files from the server even when they should not be able to.
How can the Wholesale Market for WooCommerce WordPress plugin be fixed?
To fix CVE-2022-4108, update to version 1.0.8 or later of the plugin.