CVE-2022-4109

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected software

VendorProductVersions
UnknownWholesale Market for WooCommerce< 2.0.0

References

Timeline

Published
Jan 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-410905.9Windows Point-to-Point Tunneling Protocol Denial of Service VulnerabilityCVE-2022-410915.4Windows Mark of the Web Security Feature Bypass VulnerabilityCVE-2022-410927.8Windows Win32k Elevation of Privilege VulnerabilityCVE-2022-410937.8Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityCVE-2022-410947.8Windows Hyper-V Elevation of Privilege VulnerabilityCVE-2022-410957.8Windows Digital Media Receiver Elevation of Privilege VulnerabilityCVE-2022-410967.8Microsoft DWM Core Library Elevation of Privilege VulnerabilityCVE-2022-410976.5Network Policy Server (NPS) RADIUS Protocol Information Disclosure VulnerabilityCVE-2022-410985.5Windows GDI+ Information Disclosure VulnerabilityCVE-2022-410994.6BitLocker Security Feature Bypass VulnerabilityCVE-2022-41104.8The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such asCVE-2022-411007.8Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
CVE-2022-4109: Low severity, CVSS 2.7 | Vulnix