Vulnerability · Published Aug 22, 2022 · Assigned by WPScan
CVE-2022-2557WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion
High 8.8
In plain English
A high-severity path traversal in Team – WordPress Team Members Showcase Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.6%top 23.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Team – WordPress Team Members Showcase Plugin | 4.1.2 – before 4.1.2 |
Weakness: CWE-22