CVE-2022-1777: filr_project filr Missing Authorization
Vulnerability summary
CVE-2022-1777 is a high (CVSS 8.8) Missing Authorization vulnerability in filr_project filr. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.2.2.1.
Timeline
- 13-06-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:LDiffers
EPSS trend
Probability
1.27%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Filr_project1 product
- filr< 1.2.2.1
Unknown1 product
- filr – secure document library≥ 1.2.2.1, < 1.2.2.1
Wordpress1 product
- filr-protection< 1.2.2.1
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/a50dc7f8-a9e6-41fa-a047-ad1c3bc309b4X Refsource MISCExploitThird Party Advisory