Non notée
CVE-2022-0779 The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX…
Description
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| User Meta – User Profile Builder and User management plugin 2.4 | premières → < 2.4.4 | 2.4.4 |