vulnerability

WordPress Plugin: download-monitor: CVE-2022-2222: Files or Directories Accessible to External Parties

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:P/I:N/A:N)

Published

Jun 27, 2022

Added

May 15, 2025

Modified

Apr 30, 2026

Description

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Solution

download-monitor-plugin-cve-2022-2222

References

https://www.cve.org/CVERecord?id=CVE-2022-2222
https://www.wordfence.com/threat-intel/vulnerabilities/id/1ce15d38-c5bc-441b-976a-60a3e90b5a30?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34502
CVE-2022-2222
https://attackerkb.com/topics/CVE-2022-2222
CWE-552
EUVD-EUVD-2022-34502

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report