CVE-2022-4030: 
WordPress vulnerability analysis and mitigation

The Simple:Press plugin for WordPress was identified with a Path Traversal vulnerability (CVE-2022-4030) affecting versions up to and including 6.8. The vulnerability was discovered and reported by security researchers Luca Greeb and Andreas Krüger, with the CVE being assigned on November 16, 2022 (MITRE CVE).

The vulnerability exists in the user avatar deletion functionality where the 'file' parameter can be manipulated. It received a CVSS score of 8.1 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The technical nature of the vulnerability allows for path traversal attacks that can be executed by users with minimal permissions, such as subscribers (Wordfence Advisory).

The vulnerability enables attackers to delete arbitrary files on the server, including critical system files such as wp-config.php. This level of access could allow an attacker to reconfigure the site and potentially achieve remote code execution (NVD).

Users of the Simple:Press plugin should immediately update to a version newer than 6.8 to address this vulnerability. The fix was implemented in the WordPress plugin repository (WordPress Plugin).