CVE-2022-41840 HIGH

CVE-2022-41840: WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability

Vendor Collne Inc.

Product Welcart e-Commerce (WordPress plugin)

Weakness CWE-22 · Path traversal

Published November 18, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Welcart e-Commerce WordPress plugin version 2.7.7 and earlier contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft a malicious request to access sensitive files outside the intended directory, such as configuration files containing database credentials or other private data. No user interaction or authentication is required to exploit this flaw.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server, including configuration files and other sensitive data.

Potential impact on your site

04Site Impact

Attackers can access sensitive files like wp-config.php, potentially exposing database credentials and API keys.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 18, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-41840 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

Identifiers

CVE CVE-2022-41840

CWE CWE-22

CVSS 7.5 / HIGH

Affected versions