CVE-2022-0679

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06806.1The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable op CVE-2022-06816.5The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attacker CVE-2022-06836.1The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization CVE-2022-06844.8The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to CVE-2022-06857.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.CVE-2022-06869.1Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.CVE-2022-06878.8The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to CVE-2022-06884.9Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06895.3Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06906.1Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06919.8Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.CVE-2022-06926.1Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.