CVE-2022-2557

CVE-2022-2557: WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

Vendor Unknown

Product Team – WordPress Team Members Showcase Plugin

Weakness CWE-22 · Path traversal

Published August 22, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2557 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2026-35485 text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication CVE-2022-3560 CVE-2021-47849 Mini Mouse 9.3.0 - Local File inclusion / Path Traversal CVE-2025-65075 Arbitrary File Read and Delete via Path Traversal in WaveStore Server CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace