CVE-2022-4794: AAWP < 3.12.3 - Unsafe URL Handling
Published Jan 30, 2023
·Updated
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
Affected Software
1 affected component
Getaawp Amazon Affiliate Wordpress Plugin Wordpress<3.12.3
Event History
Jan 30, 2023
CVE Published
via MITRE·08:31 PM
Data Sourced
via MITRE·08:31 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2022-4794?
CVE-2022-4794 is a vulnerability in the AAWP WordPress plugin before version 3.12.3 that allows the abuse of trusted domains to load malware or other files through it, bypassing firewall rules.
2
How can CVE-2022-4794 be exploited?
CVE-2022-4794 can be exploited by an attacker to load malware or other files through the AAWP plugin using trusted domains.
3
What is the severity of CVE-2022-4794?
The severity of CVE-2022-4794 is high with a CVSS score of 7.5.
4
What software versions are affected by CVE-2022-4794?
Versions before 3.12.3 of the AAWP WordPress plugin are affected by CVE-2022-4794.
5
How can I fix CVE-2022-4794?
To fix CVE-2022-4794, update the AAWP WordPress plugin to version 3.12.3 or later.