CVE-2022-2945
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
06/09/2022
Last modified:
11/01/2024
Description
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information.
Impact
Base Score 3.x
2.70
Severity 3.x
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:connekthq:ajax_load_more:*:*:*:*:*:wordpress:*:* | 5.5.3 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9
- https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txt
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8957413c-95e0-49c8-ba8a-02b9b5141e08?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2945



