CVE-2022-2863

The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

20.67% chance of exploitation in the next 30 days, 97th percentile

Nuclei

medium · CWE-22

Published

2022-09-16

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html
• https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2863.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-2862
• CVE-2022-28664
• CVE-2022-28601
• CVE-2022-28665
• CVE-2022-28599
• CVE-2022-28666