CVE-2022-2222 — Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users suc…
Published: 2022-07-17 · CVSS: Unscored
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7