CVE-2022-50954

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50954
WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the controller parameter in tblight.php. Attackers can supply path traversal sequences through the controller GET parameter to include arbitrary files outside the intended controllers directory.

6.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wordpress.org/plugins/cab-fare-calculator/
https://www.exploit-db.com/exploits/50843
https://www.vulncheck.com/advisories/wordpress-plugin-cab-fare-calculator-local-file-inclusion
Configurations

No configuration.

History

24 Jul 2026, 19:10

Type Values Removed Values Added
Summary
  • (es) El plugin de WordPress cab-fare-calculator 1.0.3 contiene una vulnerabilidad de inclusión local de ficheros que permite a atacantes no autenticados leer ficheros arbitrarios manipulando el parámetro controller en tblight.php. Los atacantes pueden proporcionar secuencias de salto de ruta a través del parámetro GET controller para incluir y ejecutar ficheros fuera del directorio de controladores previsto.

26 May 2026, 00:16

Type Values Removed Values Added
Summary (en) WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the controller parameter in tblight.php. Attackers can supply path traversal sequences through the controller GET parameter to include and execute files outside the intended controllers directory. (en) WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the controller parameter in tblight.php. Attackers can supply path traversal sequences through the controller GET parameter to include arbitrary files outside the intended controllers directory.

10 May 2026, 13:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-10 13:16

Updated : 2026-07-24 19:10

NVD link : CVE-2022-50954

Mitre link : CVE-2022-50954

CVE.ORG link : CVE-2022-50954

JSON object : View

Products Affected

No product.

CWE
CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')