CVE-2022-4031

The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply paths to arbitrary files on the server that can be modified outside of the intended scope of the plugin.

• CWE-22
• CWE-22

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead1a18-9429-472e-9e88-e792eaa23ae9?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4031Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4031Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40304An issue was discovered in libxml2 before 2.10.3. Certain in…7.8
• CVE-2022-40305A Server-Side Request Forgery issue in Canto Cumulus through…9.8
• CVE-2022-40306The login form /Login in ECi Printanista Hub (formerly FMAud…5.9
• CVE-2022-40307An issue was discovered in the Linux kernel through 5.19.8. …4.7
• CVE-2022-40308If anonymous read enabled, it's possible to read the databas…7.5
• CVE-2022-40309Users with write permissions to a repository can delete arbi…4.3
• CVE-2022-40310Authenticated (subscriber+) Race Condition vulnerability in …3.1
• CVE-2022-40311Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat A…4.8
• CVE-2022-40312Server-Side Request Forgery (SSRF) vulnerability in GiveWP G…6.5
• CVE-2022-40313Recursive rendering of Mustache template helpers containing …7.1
• CVE-2022-40314A remote code execution risk when restoring backup files ori…9.8
• CVE-2022-40315A limited SQL injection risk was identified in the "browse l…9.8