CVE-2022-2943

The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.

• CWE-22
• CWE-22
• CWE-22

• https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9Exploit, Third Party Advisory
• https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txtRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6d643d07-7533-430b-a1d8-8e66a2a2c5e6?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2943Third Party Advisory
• https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9Exploit, Third Party Advisory
• https://plugins.svn.wordpress.org/ajax-load-more/tags/5.5.4/README.txtRelease Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6d643d07-7533-430b-a1d8-8e66a2a2c5e6?source=cveThird Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2943Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29424Authenticated (admin or higher user role) Reflected Cross-Si…4.8
• CVE-2022-29425Cross-Site Scripting (XSS) vulnerability in WP Wham's Checko…6.1
• CVE-2022-29426Authenticated (contributor or higher user role) Reflected Cr…5.4
• CVE-2022-29427Cross-Site Request Forgery (CSRF) vulnerability in Aftab Mun…8.8
• CVE-2022-29428Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slid…4.8
• CVE-2022-29429Remote Code Execution (RCE) in Alexander Stokmann's Code Sni…8.8
• CVE-2022-29430Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to J…6.1
• CVE-2022-29431Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT…5.4
• CVE-2022-29432Multiple Authenticated (administrator or higher user role) P…4.8
• CVE-2022-29433Authenticated (contributor or higher role) Cross-Site Script…5.4
• CVE-2022-29434Insecure Direct Object References (IDOR) vulnerability in Sp…5.4
• CVE-2022-29435Cross-Site Request Forgery (CSRF) vulnerability in Alexander…5.4