CVE-2022-4107: 
WordPress vulnerability analysis and mitigation

CVE-2022-4107 affects the SMSA Shipping for WooCommerce WordPress plugin versions before 1.0.5. The vulnerability was discovered and publicly disclosed on November 22, 2022. This security issue impacts WordPress installations using the affected plugin versions (WPScan).

The vulnerability stems from multiple security control failures in the plugin. Specifically, it lacks proper authorization mechanisms and CSRF (Cross-Site Request Forgery) checks. Additionally, the plugin fails to validate files during download operations. The vulnerability has been assigned a CVSS score of 7.7 (High), indicating its significant severity level (WPScan).

The vulnerability allows any authenticated user, including those with minimal privileges such as subscribers, to download arbitrary files from the server. This could lead to unauthorized access to sensitive files and potential exposure of confidential information, including critical WordPress configuration files (WPScan).

The vulnerability is relatively easy to exploit. An authenticated attacker can exploit this vulnerability by accessing a specific URL pattern with a path traversal payload to download arbitrary files from the server. A proof of concept exists that demonstrates accessing the wp-config.php file through the path: /wp-admin/admin-ajax.php?action=ced_smsa_get_pfd_download&filename=../../../../wp-config.php (WPScan).

The vulnerability has been patched in version 1.0.5 of the SMSA Shipping for WooCommerce plugin. Users are strongly advised to update to this version or later to protect their installations (WPScan).