CVE-2018-7422
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 62%
from disclosure to weapon4 days
Published on NVDMar 19
1st PoC+4d
VulnCheck+1120d
exploitation probability
62%top 1% of all CVEs
observed exploitation
yesVulnCheck
9 public exploit(s)
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
Affected products
n/a · n/apublic PoCs found — 9✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44340githubgithub.com/0x00-0x00/CVE-2018-7422★ 1githubgithub.com/ndr-repo/CVE-2018-7422★ 1githubgithub.com/nguyenduytoi/CVE-2018-7422★ 0cve_referencewww.exploit-db.com/exploits/44340/unverifiedvulncheckvulncheck.com/xdb/1358f36bad71unverifiedvulncheckvulncheck.com/xdb/bcdd6092f636unverifiedvulncheckvulncheck.com/xdb/ee0a8a694cfdunverifiedvulncheckvulncheck.com/xdb/180caec8c9daunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.