CVE-2023-6222: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2023-6222) affects the Quttera Web Malware Scanner WordPress plugin versions below 3.4.2.1. Discovered and reported by Dmitrii Ignatyev on November 21, 2023, this vulnerability allows users with admin privileges to perform path traversal attacks due to improper input validation in file path handling (WPScan).

The vulnerability is classified as a path traversal (CWE-22) with a CVSS score of 4.1 (medium). The issue stems from the plugin's failure to validate user input used in file paths, specifically in the file viewing functionality. This vulnerability falls under the OWASP Top 10 category A1: Injection (WPScan).

When exploited, this vulnerability allows authenticated administrators to perform path traversal attacks, potentially accessing sensitive files outside the intended directory structure. This could lead to unauthorized access to system files and exposure of sensitive information (WPScan).

The vulnerability has been patched in version 3.4.2.1 of the Quttera Web Malware Scanner plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).