Lucene search
WPScanCVELIST:CVE-2022-4236HistoryJan 02, 2023 - 9:49 p.m.
CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
2023-01-0221:49:30
WPScan
www.cve.org
welcart e-commerce
wordpress
file access
ajax
user input
arbitrary files
server security
0.001 Low
EPSS
Percentile
29.7%
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Welcart e-Commerce",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "2.8.5"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
nvd
nvd
CVE-2022-4236
2023-01-02 22:15:16
cve
cve
CVE-2022-4236
2023-01-02 22:15:16
prion
prion
Input validation
2023-01-02 22:15:00
wpexploit
wpexploit
Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
2022-12-05 00:00:00
wpvulndb
wpvulndb
Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
2022-12-05 00:00:00