VULNERABILITY INTELLIGENCE

CVE-2022-2981

CVSS score4.9 MEDIUM
EPSS probability1.11%
CISA KEVNot currently listed
Published2022-10-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Description

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Weakness classification

  • contact@wpscan.com: CWE-552

Primary references