medium6.5
CVE-2022-4236
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available …
Impact
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Welcart | Welcart E-Commerce | before 2.8.5 |