CVE-2022-2357

WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.

Affected

WSM Downloader

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.43% chance of exploitation in the next 30 days, 73rd percentile

Published

2022-08-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/42499b84-684e-42e1-b7f0-de206d4da553

References

• CVE Record
• NVD entry