CVE-2022-2638

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

EPSS

1.14% chance of exploitation in the next 30 days, 64th percentile

Published

2022-08-29

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/70840a72-ccdc-4eee-9ad2-874809e5de11

References

• CVE Record
• NVD entry

Related

• CVE-2022-26377
• CVE-2022-26382
• CVE-2022-26376
• CVE-2022-26385
• CVE-2022-26364
• CVE-2022-26387