CVE-2022-33901

published 2022-07-22

CVE-2022-33901: Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.

Priority P3 54 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
multisafepay	multisafepay_plugin_for_woocommerce	<= 4.15.0	—

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php?action=admin_init&log_filename=../../../../../../../../../../../../../etc/passwd↗

other action=admin_init&log_filename=../../../../../../../../../../../../../etc/passwd↗

• → HTTP GET request to wp-admin/admin-ajax.php with 'action=admin_init' and a 'log_filename' parameter containing path traversal sequences targeting /etc/passwd — no authentication required. ↗
• → Successful exploitation returns HTTP 200 with Content-Type header 'application/octet-stream' and a response body matching the regex 'root:.*:0:0:' (indicative of /etc/passwd content). ↗
• → The vulnerability is unauthenticated (PR:N) — monitor for path traversal patterns in the 'log_filename' query parameter on WordPress AJAX endpoints without any session/auth cookies. ↗

• · Affected versions are MultiSafepay for WooCommerce <= 4.13.1; detections should be scoped to sites running this plugin version range. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-552