CVE-2022-4108

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Dec 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-410808.8Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2022-410818.1Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCVE-2022-410828.0Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2022-410837.8Visual Studio Code Elevation of Privilege VulnerabilityCVE-2022-410857.5Azure CycleCloud Elevation of Privilege VulnerabilityCVE-2022-410866.4Windows Group Policy Elevation of Privilege VulnerabilityCVE-2022-410888.1Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCVE-2022-410897.8.NET Framework Remote Code Execution VulnerabilityCVE-2022-41092.7The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing higCVE-2022-410905.9Windows Point-to-Point Tunneling Protocol Denial of Service VulnerabilityCVE-2022-410915.4Windows Mark of the Web Security Feature Bypass VulnerabilityCVE-2022-410927.8Windows Win32k Elevation of Privilege Vulnerability
CVE-2022-4108: Medium severity, CVSS 4.9 | Vulnix