blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-4023

MEDIUM 5.3 CVSS 3.1
Published
July 17, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.

Affected products and versions

  • Unknown 3dprint — Before 3.5.6.9
  • 3dprint_project 3dprint — Before 3.5.6.9

References

  • jetpack.com https://jetpack.com/blog/vulnerabilities-found-in-the-3dprint-premium-plugin/ Exploit
  • wpscan.com https://wpscan.com/vulnerability/859c6e7e-2381-4d93-a526-2000b4fb8fee Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record