CVE-2022-2943

CVE-2022-2943 is an arbitrary file reading vulnerability affecting the WordPress Infinite Scroll – Ajax Load More plugin, specifically in versions up to and including 5.5.3. The vulnerability stems from insufficient file path validation in the alm_repeaters_export() function. This allows authenticated attackers with administrative privileges to download sensitive files from the server, such as wp-config.php. Rated with a CVSS score of 4.9 (Medium), the vulnerability has a network attack vector and low attack complexity, but requires high privileges. Successful exploitation could lead to high confidentiality impact by exposing sensitive data. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention.