CVE-2022-4108

Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)

Affected

Wholesale Market for WooCommerce

CVSS v3.1 NVD

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.85% chance of exploitation in the next 30 days, 58th percentile

Published

2022-12-19

Updated

2025-04-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470

References

• CVE Record
• NVD entry