CVE-2022-2367

CVE-2022-2367: WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass

Vendor Unknown

Product WSM Downloader

Weakness CWE-639 · IDOR

Published August 8, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation

Key dates

02Disclosure timeline

August 8, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2367 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2025-65034 Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId CVE-2023-32669 Authorization Bypass on BuddyBoss CVE-2026-11461 NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization CVE-2022-1580 Site Offline < 1.5.3 - Access Bypass CVE-2026-22393 WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability