CVE-2022-2945
WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal
LOW 2.7EPSS 1.7%
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected
- dcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy Load
- CVSS v3.1 NVD
- 2.7 LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - CVSS v3.1 WORDFENCE
- 4.9 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - EPSS
- 1.73% chance of exploitation in the next 30 days, 77th percentile
- Published
- 2022-09-06
- Updated
- 2026-04-08
Proof-of-concept exploits (1)
Security advisories
- https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txt
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2945