CVE-2022-0656: uDraw < 3.3.3 - Unauthenticated Arbitrary File Access

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-25 · updated 2026-06-17
Weakness: CWE-552

Description

The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)

Affected products

Web To Print Shop : uDraw: before 3.3.3 — fixed in 3.3.3

How to fix

Upgrade to a fixed version: Web To Print Shop : uDraw 3.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0656 or the next vulnerability affects your stack