CVE-2022-0779: vulnerability in User Meta – User Profile Builder and User…
User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.4%
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
Related CVEs — User Meta – User Profile Builder and User…
In the same product, most dangerous first.