Skip to main content

Wp Ecommerce CVE-2022-45833

MEDIUM
Path Traversal (CWE-22)
2022-12-06 audit@patchstack.com
WordPress Path Traversal Wp Ecommerce Easy Wp Smtp
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 06, 2022 - 22:15 nvd
MEDIUM 6.5

DescriptionNVD

Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

AnalysisAI

Auth. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. Affected products include: Wp-Ecommerce Easy Wp Smtp.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Wp Ecommerce

View all
CVE-2019-25141 CRITICAL POC
9.8 Jun 07

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. Rat
CVE-2020-35234 HIGH POC
7.5 Dec 14

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in De
CVE-2022-3334 HIGH POC
7.2 Oct 31

The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP obj
CVE-2022-42699 CRITICAL
9.1 Dec 06

Auth. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor p
CVE-2024-1514 CRITICAL
9.8 Feb 28

The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter

CVE-2022-45829 HIGH
8.7 Dec 06

Auth. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
CVE-2017-7723 MEDIUM
6.1 Apr 24

XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body. Rated medium severity (CV
CVE-2024-35676 MEDIUM
5.4 Jun 08

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce
CVE-2024-1516 MEDIUM
5.3 Feb 28

The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability

CVE-2024-3073 LOW
2.7 Jun 13

The Easy WP SMTP by SendLayer - WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information ex

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2022-45833 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy