CVE-2022-2222— Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
Quick assessment
Affected
Unknown Download Monitor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Download Monitor 4.5.91之前的版本存在安全漏洞，该漏洞源于该插件不确保要下载的文件在博客文件夹内，并且不敏感，即使在强化环境或多站点设置中，管理员等高权限用户也可以下载 wp-config.php 或 /
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-2222
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
Source: CVE Program / CVE List V5
Vulnerability Description
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对外部实体的文件或目录可访问
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Download Monitor 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Download Monitor 4.5.91之前的版本存在安全漏洞，该漏洞源于该插件不确保要下载的文件在博客文件夹内，并且不敏感，即使在强化环境或多站点设置中，管理员等高权限用户也可以下载 wp-config.php 或 /
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Download Monitor | 4.5.91 ~ 4.5.91 | - |
|
II. Public POCs for CVE-2022-2222
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-2222
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-2222 (1)
Same Patch Batch · Unknown · 2022-07-17 · 21 CVEs total
| CVE-2022-2144 | Jquery Validation For Contact Form 7 < 5.3 - Arbitrary Options Update via CSRF | |
| CVE-2021-24655 | WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise | |
| CVE-2022-1672 | Insights from Google PageSpeed < 4.0.7 - Multiple CSRF | |
| CVE-2022-1933 | CDI < 5.1.9 - Reflected Cross-Site-Scripting | |
| CVE-2022-2090 | Woo Discount Rules < 2.4.2 - Reflected Cross-Site Scripting | |
| CVE-2022-2099 | WooCommerce < 6.6.0 - Admin+ Stored HTML Injection | |
| CVE-2022-2100 | Page Generator Plugin < 1.6.5 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2114 | Data Tables Generator by Supsystic < 1.10.20 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2118 | 404s < 3.5.1 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2133 | OAuth Single Sign On < 6.22.6 - Authentication Bypass | |
| CVE-2022-2194 | Accept Stripe Payments < 2.0.64 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2146 | Import CSV Files <= 1.0 - Reflected Cross-Site Scripting | |
| CVE-2022-2148 | LinkedIn Company Updates <= 1.5.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2149 | Very Simple Breadcrumb <= 1.0 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2151 | Best Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2168 | Download Manager < 3.2.44 - Reflected Cross-Site Scripting | |
| CVE-2022-2169 | Loading Page with Loading Screen < 1.0.83 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2173 | Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting | |
| CVE-2022-2186 | Simple Post Notes < 1.7.6 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2187 | Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting |
IV. Related Vulnerabilities
Same product: Download Monitor
-
CVE-2026-16608
Download Monitor < 5.2.6 - Unauthenticated Download Log Inje -
CVE-2026-39489
WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary F -
CVE-2026-39486
WordPress Download Monitor plugin <= 5.1.8 - SQL Injection v -
CVE-2026-4401
Download Monitor <= 5.1.10 - Cross-Site Request Forgery to D -
CVE-2026-3124
Download Monitor <= 5.1.7 - Insecure Direct Object Reference
Same vendor: Unknown
-
CVE-2026-92540
Import and export users and customers < 2.5.2 - Custom Role -
CVE-2026-92541
Import and export users and customers < 2.5.2 - Custom Role -
CVE-2026-92965
TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption -
CVE-2026-92422
Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode E -
CVE-2026-92423
Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclo
Same weakness: CWE-552
-
CVE-2026-77884
Gallery - Private Photo Vault 1.0.41 - Unauthenticated local -
CVE-2026-68831
Windows Defender Firewall Service Information Disclosure Vul -
CVE-2026-67402
WebPros ConfigServer Security & Firewall 权限许可和访问控制问题漏洞 -
CVE-2026-85175
SiYuan before v3.8.2 TLS Private Key Disclosure via getFile -
CVE-2026-82020
Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via
V. Comments for CVE-2022-2222
No comments yet