CVE-2022-0779
Published: 08 June 2022
Summary
CVE-2022-0779 is a medium-severity Path Traversal (CWE-22) vulnerability in User-Meta User Meta User Profile Builder And User Management. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The User Meta WordPress plugin before version 2.4.4 contains a path traversal vulnerability (CWE-22) in its um_show_uploaded_file AJAX action. The plugin fails to validate the filepath parameter, allowing unauthorized access to arbitrary files on the underlying web server. The issue received a CVSS 3.1 score of 6.5 and affects any site running the plugin with the AJAX endpoint exposed.
Low-privileged users, including subscribers, can exploit the flaw over the network by sending crafted requests to the AJAX handler. Successful exploitation grants read access to sensitive local files, resulting in high confidentiality impact without requiring user interaction or elevated privileges.
The EPSS score reached a peak of 0.1663 after disclosure before settling at 0.1366, indicating measurable post-publication exploitation interest. WPScan entries for the vulnerability recommend upgrading to User Meta 2.4.4 or later to close the path traversal vector.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15831
Vulnerability details
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.