Monitor free

Report

New Known

Exploited

Fixed

WordPress WPIDE – File Manager & Code Editor plugin <= 2.6 - Authenticated Local File Inclusion (LFI) vulnerability

4.9

CVSS 3.1 score Medium severity

Report

Monitoring Monitoring Known to be exploited Coming soon

Find out about vulnerable plugins in your websites for free.

Scan your website

Software

WPIDE – File Manager & Code Editor

Type

Plugin

Vulnerable versions

<= 2.6

Fixed in

3.0

PSID

55ff656455e6

CVE ID

CVE-2022-2261

Classification

Local File Inclusion

OWASP Top 10

A1: Injection

Required privilege

Requires high role user authentication like admin.

Credits

Raad Haddad

Publicly disclosed

2022-08-03

Patchstack vPatch available since

09.12.2021

Details

Authenticated Local File Inclusion (LFI) vulnerability discovered by Raad Haddad in WordPress WPIDE – File Manager & Code Editor plugin (versions <= 2.6).

Solution

Update the WordPress WPIDE – File Manager & Code Editor plugin to the latest available version (at least 3.0).

References