CVE-2022-4108

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.80% chance of exploitation in the next 30 days, 54th percentile

Published

2022-12-19

Updated

2025-04-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9d1770df-91f0-41e3-af0d-522ae4e62470

References

• CVE Record
• NVD entry

Related

• CVE-2022-41076
• CVE-2022-41080
• CVE-2022-4107
• CVE-2022-41082
• CVE-2022-4106
• CVE-2022-4109