CVE-2022-2638 describes a critical vulnerability in the Export All URLs WordPress plugin prior to version 4.4, affecting the atlasgondal export_all_urls product. This flaw allows highly privileged users to delete arbitrary files from the server due to insufficient validation of the file path during the removal of the CSV file. The vulnerability carries a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring high privileges, and resulting in high impact to both integrity and availability. This means an attacker with administrative access could easily exploit this to cause significant damage. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low awareness and no immediate widespread threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.4CPE matchmatch criteria | cpe:2.3:a:atlasgondal:export_all_urls:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.