CVE-2022-2357

CVE-2022-2357: WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download

Vendor Unknown

Product WSM Downloader

Weakness CWE-552 · Files accessible externally

Published August 8, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.

Key dates

02Disclosure timeline

August 8, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2357 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/552.html

Related vulnerabilities

04Related CVE

CVE-2023-32684 In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file CVE-2023-39480 Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vulnerability CVE-2026-29066 Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI CVE-2025-61734 Apache Kylin: improper restriction of file read CVE-2021-32833 Unauthenticated file read in Emby Server