CVE-2022-4106

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published
Dec 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-410605.5Microsoft Word Information Disclosure VulnerabilityCVE-2022-410617.8Microsoft Word Remote Code Execution VulnerabilityCVE-2022-410628.8Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2022-410637.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2022-410645.8.NET Framework Information Disclosure VulnerabilityCVE-2022-410664.4Microsoft Dynamics Business Central Information Disclosure VulnerabilityCVE-2022-41076.5The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not valiCVE-2022-410737.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-410745.5Windows Graphics Component Information Disclosure VulnerabilityCVE-2022-410768.5PowerShell Remote Code Execution VulnerabilityCVE-2022-410777.8Windows Fax Compose Form Elevation of Privilege VulnerabilityCVE-2022-410788.0Microsoft Exchange Server Spoofing Vulnerability
CVE-2022-4106: High severity, CVSS 7.5 | Vulnix