PT-2022-20753 · WordPress · Givewp

Rafie Muhammad · CVE-2022-31475 · Published 2022-07-21 · Updated 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions GiveWP plugin versions <= 2.20.2

Description The issue is related to an authenticated arbitrary file read vulnerability via the export function in the GiveWP plugin for WordPress. This vulnerability can be exploited by users with a custom plugin role.

Recommendations For GiveWP plugin versions <= 2.20.2, update to a version greater than 2.20.2 to resolve the issue. As a temporary workaround, consider restricting access to the export function to minimize the risk of exploitation.

Fix

Improper Access Control

Path traversal

Files Accessible to External Parties

Weakness Enumeration

CWE-284

CWE-22

CWE-552

Related Identifiers

CVE-2022-31475

Affected Products

Givewp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-31475 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31475 · Vendor Advisory
• https://wordpress.org/plugins/give/#developers · Note
• https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-20-2-authenticated-arbitrary-file-read-via-export-function-vulnerability · Note
• https://t.me/cibsecurity/46774 · Telegram Post