CVE-2022-4298

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	Wholesale Market	< 2.2.1

References

https://wpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478Exploit, Third Party Advisory
https://wpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478Exploit, Third Party Advisory

Timeline

Published: Jan 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-429809.8go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.CVE-2022-429827.5BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typic CVE-2022-429838.8anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.CVE-2022-429849.8WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=se CVE-2022-429854.8The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator pr CVE-2022-429899.0ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.CVE-2022-42994.8The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-429907.2Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=C CVE-2022-429915.4A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scri CVE-2022-429925.4Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or H CVE-2022-429935.4Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.CVE-2022-429989.8D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.