CVE-2022-4972highexplotación observadaCWE-862

CVE-2022-4972: fallo de gravedad alta en wpchill Download Monitor

Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Download Monitor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 7.5epss 0.5%
de la publicación al arma
Publicada en NVD16 oct
VulnCheck15 oct
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
wpchill · Download Monitor
CVEs relacionadas — wpchill Download Monitor

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10092MEDIUMDownload Monitor <= 5.0.12 - Missing Authorization to API Key ManipulationEPSS 0.5%CVE-2024-10399MEDIUMDownload Monitor <= 5.0.13 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2024-8552MEDIUMDownload Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop EnableEPSS 0.4%CVE-2026-100182HIGHDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin EditorEPSS 0.3%CVE-2024-3269MEDIUMDownload Monitor <= 4.9.13 - Missing AuthorizationEPSS 0.3%CVE-2026-3124HIGHDownload Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'EPSS 0.3%