CVE-2022-2557 WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

2022-08-2215:04:22

CWE-22

WPScan

www.cve.org

wordpress

team members

plugin

arbitrary file read

path traversal

file deletion

security vulnerability

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

35.6%

JSON

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user

CNA Affected

[
  {
    "product": "Team – WordPress Team Members Showcase Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.1.2",
        "status": "affected",
        "version": "4.1.2",
        "versionType": "custom"
      }
    ]
  }
]