CVE-2022-45833 MEDIUM

CVE-2022-45833: WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal

Vendor Wpecommerce, Alexanderfoxc
Product Easy WP SMTP
Weakness CWE-22 · Path traversal
Published December 6, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

Easy WP SMTP versions up to 1.5.1 contain a path traversal vulnerability that allows high-privilege users to read arbitrary files from the server. An attacker with admin or equivalent access can bypass file restrictions and access sensitive files outside the intended directory. The vulnerability requires administrative credentials to exploit.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server filesystem.

Potential impact on your site

04Site Impact

An admin account compromise could expose sensitive configuration files, database credentials, or other private data stored on the server.

Conditions required to exploit

05Prerequisites

Attacker must have high-level privileges (admin or equivalent) on the WordPress site.

Key dates

06Disclosure timeline

December 6, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-14487 Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter CVE-2026-11367 PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter CVE-2026-57401 WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter CVE-2026-9145 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'