CVE-2022-4030

The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to arbitrary files on the server that will subsequently be deleted. This can be used to delete the wp-config.php file that can allow an attacker to configure the site and achieve remote code execution.

• CWE-22
• CWE-22

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/43bcf3ab-4201-4a61-82c5-2dc60b684989?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4030Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4030Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40294 The application was identified to have an CSV injection in …8.8
• CVE-2022-40295The application was vulnerable to an authenticated informati…4.9
• CVE-2022-40296 The application was vulnerable to a Server-Side Request For…9.8
• CVE-2022-40297UBports Ubuntu Touch 16.04 allows the screen-unlock passcode…7.8
• CVE-2022-40298Crestron AirMedia for Windows before 5.5.1.84 has insecure i…8.8
• CVE-2022-40299In Singular before 4.3.1, a predictable /tmp pathname is use…7.8
• CVE-2022-40300Zoho ManageEngine Password Manager Pro through 12120 before …9.8
• CVE-2022-40302An issue was discovered in bgpd in FRRouting (FRR) through 8…6.5
• CVE-2022-40303An issue was discovered in libxml2 before 2.10.3. When parsi…7.5
• CVE-2022-40304An issue was discovered in libxml2 before 2.10.3. Certain in…7.8
• CVE-2022-40305A Server-Side Request Forgery issue in Canto Cumulus through…9.8
• CVE-2022-40306The login form /Login in ECi Printanista Hub (formerly FMAud…5.9