CVE-2022-4794

AAWP < 3.12.3 - Unsafe URL Handling

The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.

Affected

AAWP

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.80% chance of exploitation in the next 30 days, 56th percentile

Published

2023-01-30

Updated

2025-03-28

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/feb4580d-df15-45c8-b59e-ad406e4b064c

References

• CVE Record
• NVD entry