CVE-2022-4794: 
WordPress vulnerability analysis and mitigation

The CVE-2022-4794 vulnerability affects the AAWP (Amazon Affiliate WordPress Plugin) versions before 3.12.3. This security flaw was discovered and publicly disclosed on January 4, 2023. The vulnerability allows potential attackers to abuse trusted domains to load malware or other files through the plugin, potentially bypassing corporate firewall rules (WPScan Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue specifically involves the plugin's image.php file, which can be exploited using the path 'wp-content/aawp/public/image.php?url=[base64-url]' to load and download files from base64-decoded URLs (NVD, WPScan Advisory).

The vulnerability enables attackers to bypass corporate firewall rules by leveraging trusted domains to load potentially malicious files. This could lead to the distribution of malware through otherwise trusted WordPress installations (WPScan Advisory).

The vulnerability has been patched in version 3.12.3 of the AAWP plugin. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan Advisory).