CVE-2022-4109: Wholesale Market for WooCommerce < 2.0.0 - Admin+ Arbitrary Log Download

Severity: low (CVSS 2.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-02 · updated 2026-06-17

Description

The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)

Affected products

Wholesale Market for WooCommerce: before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: Wholesale Market for WooCommerce 2.0.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/51e023de-189d-4557-9655-23f7ba58b670
https://wpscan.com/vulnerability/51e023de-189d-4557-9655-23f7ba58b670

Get alerted when CVE-2022-4109 or the next vulnerability affects your stack