Skip to main content

Givewp CVE-2022-31475

MEDIUM
Path Traversal (CWE-22)
2022-07-21 audit@patchstack.com
WordPress Path Traversal Givewp
4.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 21, 2022 - 18:15 nvd
MEDIUM 4.9

DescriptionNVD

Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

AnalysisAI

Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Affected products include: Givewp.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Givewp

View all
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-5932 CRITICAL POC
9.8 Aug 20

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2026-14319 HIGH POC
7.5 Jul 31

GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint

CVE-2026-14318 MEDIUM POC
6.8 Jul 30

Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the

CVE-2025-0912 CRITICAL
9.8 Mar 04

The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
CVE-2022-2260 MEDIUM POC
6.5 Aug 01

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
CVE-2022-0252 MEDIUM POC
6.1 Feb 21

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
CVE-2021-24213 MEDIUM POC
6.1 Apr 12

The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
CVE-2019-9909 MEDIUM POC
6.1 Mar 22

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
CVE-2026-82222 CRITICAL
10.0 Aug 28

Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote
CVE-2024-9634 CRITICAL
9.8 Oct 16

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-37099 CRITICAL
9.8 Aug 19

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severi

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2022-31475 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy