CVE-2022-4031

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply paths to arbitrary files on the server that can be modified outside of the intended scope of the plugin.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-403103.1Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to CVE-2022-403114.8Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.CVE-2022-403126.5Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Don CVE-2022-403137.1Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load CVE-2022-403149.8A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.CVE-2022-403159.8A limited SQL injection risk was identified in the "browse list of users" site administration page.CVE-2022-403164.3The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers ab CVE-2022-403175.4OpenKM 6.3.11 allows stored XSS related to the javascript&colon; substring in an A element.CVE-2022-403186.5An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length CVE-2022-403197.5The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email addre CVE-2022-40326.1The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and in CVE-2022-403208.8cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.