CVE-2022-2392

CVE-2022-2392: Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download

Vendor Unknown

Product Lana Downloads Manager

Weakness CWE-552 · Files accessible externally

Published August 22, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2392 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/552.html AskarLabs — CWE-552 write-up Files or Directories Accessible to External Parties

Related vulnerabilities

04Related CVE

CVE-2025-14442 Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File CVE-2025-12747 Tainacan <= 1.0.0 - Unauthenticated Information Exposure CVE-2025-12648 WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files CVE-2025-12894 Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download