CVE-2022-44583 HIGH

CVE-2022-44583: WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability

Vendor Whatarmy
Product WatchTowerHQ (WordPress plugin)
Published November 18, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

WatchTowerHQ versions 3.6.15 and earlier contain an information disclosure vulnerability accessible over the network without authentication. An attacker can read sensitive data from the plugin without needing to log in or interact with a site administrator. This affects all installations running the vulnerable version.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the plugin without logging in.

Potential impact on your site

04Site Impact

Sensitive data exposed to unauthenticated attackers; immediate update required to prevent data leakage.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 18, 2022 CVE published
April 28, 2026 Record updated