Medium severity · published Oct 10, 2022
CVE-2022-2981
Download Monitor < 4.5.98 - Admin+ Arbitrary File Download
4.9
CVSS
1.1%
EPSS
No
On KEV
Description
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Download Monitor ·
4.5.98 before 4.5.98 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2981
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2981
Exploit
https://wpscan.com/vulnerability/30ce32ce-161c-4388-8d22-751350b7b305
More from Download Monitor
7.1
CVE-2026-112207
Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
5.3
CVE-2026-16608
Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
4.9
CVE-2026-112219
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route