PT-2022-17352 · WordPress · Enable Media Replace

Raad Haddad · Published 2022-10-10 · Updated 2022-10-11 · CVE-2022-2554

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Enable Media Replace WordPress plugin versions prior to 4.0.0

Description The issue allows high privilege users, such as admins, to potentially move files outside the Upload folder to the web root directory via a path traversal attack.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-2554

Affected Products

Enable Media Replace

References · 3

• 🔥 https://wpscan.com/vulnerability/5872f4bf-f423-4ace-b8b6-d4cc4f6ca8d9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2554 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2554 · Vendor Advisory