CVE-2022-4106

7.5 highEPSS 0.9%

High (7.5) in cedcommerce wholesale market for woocommerce. EPSS 0.9% chance of exploitation in the next 30 days.

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-552
Published: 2022-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cedcommerce:wholesale_market_for_woocommerce

References

https://wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee-7332890804ed
https://wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee-7332890804ed

Check your stack JSON