CVE-2022-4298 describes a critical arbitrary file download vulnerability in the CedCommerce Wholesale Market WordPress plugin versions prior to 2.2.1. This flaw stems from a lack of authorization checks and improper validation of user-supplied input used in system path generation. With a CVSS score of 9.8 (CRITICAL), unauthenticated attackers can remotely exploit this vulnerability with low complexity to achieve high impact across confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and community discussion is minimal, its high EPSS and FAUCET Risk Score indicate a significant potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.2.1CPE matchmatch criteria | cpe:2.3:a:cedcommerce:wholesale_market:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.