CVE-2022-0779

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads

Affected products

User Meta

User-meta User Meta User Profile Builder And User Management

< 2.4.4

Fix

Available

CVSS 3.1

6.5 MEDIUM

EPSS

2.3% (81th percentile)

Weakness

CWE-22

NVD status

Modified

Published

2022-06-06