CVE-2022-31475
MEDIUMGiveWP <= 2.20.2 - Authenticated Arbitrary File Read via Export Function
Title source: llmDescription
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
References (2)
Core 2
Core References
Release Notes, Third Party Advisory x_refsource_confirm
https://wordpress.org/plugins/give/#developers
Release Notes, Third Party Advisory x_refsource_confirm
https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-20-2-authenticated-arbitrary-file-read-via-export-function-vulnerability
Scores
CVSS v3
5.5
EPSS
0.0067
EPSS Percentile
47.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
CWE-284
CWE-552
Status
published
Products (2)
givewp/givewp
< 2.21.0
GiveWP/GiveWP (WordPress plugin)
<= 2.20.2 - 2.20.2
Published
Jul 21, 2022
Tracked Since
Feb 18, 2026