PT-2022-14113 · WordPress · Change Uploaded File Permissions

Daniel Ruf · Published 2022-06-13 · Updated 2022-06-21 · CVE-2022-1788

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Change Uploaded File Permissions WordPress plugin through 4.0.0

Description The issue is due to missing checks, making the plugin vulnerable to CSRF attacks. This vulnerability can be used to change the file and folder permissions of any folder, potentially making specific files like ini files readable for everyone.

Recommendations For versions through 4.0.0, update to a version later than 4.0.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and folders to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-1788

Affected Products

Change Uploaded File Permissions

References · 5

• 🔥 https://wpscan.com/vulnerability/c39719e5-dadd-4414-a96d-5e70a1e3d462 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1788 · Security Note
• https://t.me/cibsecurity/44265 · Telegram Post
• https://t.me/cvenotify/31509 · Telegram Post