CVE-2022-4972 — Missing Authorization in Download Monitor

CWE-862 — Missing Authorization4 documents4 sources
Severity
7.5HIGHNVD
EPSS
1.8%
top 17.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wpchill Download Monitor
Timeline
PublishedOct 16

Description

The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5wpchill/download_monitor4.7.51

🔴Vulnerability Details

3
GHSA
GHSA-88wj-fxpv-pc7g: The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related t↗2024-10-16
▶
CVEList
Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export↗2024-10-16
▶
VulnCheck
Download Monitor plugin for WordPress REST-API Routes Vulnerability↗2022
▶
CVE-2022-4972 — Missing Authorization | cvebase