CVE-2022-2554

CVE-2022-2554 describes a path traversal vulnerability in the Enable Media Replace WordPress plugin prior to version 4.0.0. This flaw allows highly privileged users, such as administrators, to move renamed files outside the intended Upload folder to the web root directory. The vulnerability has a CVSS score of 4.9 (Medium), indicating a network-based attack with low complexity, requiring high privileges to achieve a high impact on integrity but no impact on confidentiality or availability. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.