Read the docs
TI-2022-00571 Aliases CVE-2022-0656GHSA-452j-v697-rp7m

uDraw < 3.3.3 - Unauthenticated Arbitrary File Access

Priority MEDIUM 43CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-552.

Summary

The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)

Why it matters now

EPSS 0.07879 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Web To Print Shop : uDraw (Unknown): 3.3.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWeb To Print Shop : uDraw3.3.3 to before 3.3.33.3.3Patch availableCNA
  • Web To Print Shop : uDraw VendorUnknown Affected 3.3.3 to before 3.3.3 Fixed in 3.3.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:webtoprint:web_to_print_shop\:udraw:*:*:*:*:*:wordpress:*:*udrawVulnerableWebtoprint
  • cpe:2.3:a:webtoprint:web_to_print_shop\:udraw:*:*:*:*:*:wordpress:*:* Versions udraw Vulnerable ·Webtoprint

Remediation

  • Fix · CNA Web To Print Shop : uDraw (Unknown) Fixed in 3.3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0656
  2. 2026-10-03 Alias added: GHSA-452j-v697-rp7m

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences