CVE-2022-2981

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-298105.5The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.CVE-2022-298114.8In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.CVE-2022-298122.3In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficientCVE-2022-298136.7In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possibleCVE-2022-298147.7In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possibleCVE-2022-298156.7In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possibleCVE-2022-298163.2In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possibleCVE-2022-298176.1In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possibleCVE-2022-298187.1In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawedCVE-2022-298197.7In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possibleCVE-2022-29827.8Use After Free in GitHub repository vim/vim prior to 9.0.0260.CVE-2022-298203.5In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible
CVE-2022-2981: Medium severity, CVSS 4.9 | Vulnix