PT-2023-14110 · WordPress · Welcart E-Commerce

Published 2023-01-02 · Updated 2025-04-10 · CVE-2022-4236

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce WordPress plugin versions prior to 2.8.5

Description The issue concerns the Welcart e-Commerce WordPress plugin, which does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users. This could allow users with a role as low as subscriber to read arbitrary files on the server.

Recommendations For versions prior to 2.8.5, update to version 2.8.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action to prevent unauthorized file access.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2022-4236

Affected Products

Welcart E-Commerce

References · 6

• 🔥 https://wpscan.com/vulnerability/436d8894-dab8-41ea-8ed0-a3338aded635 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4236 · Security Note
• https://t.me/cvenotify/118735 · Telegram Post
• https://t.me/cibsecurity/55766 · Telegram Post
• https://t.me/cvenotify/41133 · Telegram Post