PT-2022-15295 · WordPress · Download Monitor

Filipe Baptistella + 12 · Published 2022-07-17 · Updated 2025-12-21 · CVE-2022-2222

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions prior to 4.5.91

Description The issue allows high privilege users, such as administrators, to download sensitive files like wp-config.php or /etc/passwd, even in hardened environments or multisite setups, because it does not ensure that files to be downloaded are inside the blog folders and not sensitive.

Recommendations For versions prior to 4.5.91, update to version 4.5.91 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2022-2222

Affected Products

Download Monitor

References · 7

• 🔥 https://wpscan.com/vulnerability/dd48624a-1781-419c-a3c4-1e3eaf5e2c1b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2222 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2222 · Vendor Advisory
• https://twitter.com/lovithreatintel/status/2002854213492380154 · Twitter Post
• https://t.me/cvenotify/33224 · Telegram Post
• https://t.me/cibsecurity/46402 · Telegram Post
• https://twitter.com/lovithreatintel/status/2002854220282880478 · Twitter Post