CVE-2022-2222: falha em Download Monitor
Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.1%
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Produtos afetados
Unknown · Download MonitorCVEs relacionadas — Download Monitor
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24786HIGHDownload Monitor < 4.4.5 - Admin+ SQL InjectionEPSS 17.3%CVE-2022-2981—Download Monitor < 4.5.98 - Admin+ Arbitrary File DownloadEPSS 1.1%CVE-2026-112219MEDIUMDownload Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST RouteEPSS 0.3%CVE-2026-16608MEDIUMDownload Monitor < 5.2.6 - Unauthenticated Download Log InjectionEPSS 0.3%CVE-2026-112207HIGHDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download LinkEPSS 0.2%