Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls
Priority MEDIUM 41CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
Why it matters now
EPSS 0.01294 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Filr – Secure document library (Unknown): 1.2.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Filr – Secure document library | 1.2.2.1 to before 1.2.2.1 | 1.2.2.1 | Patch available | CNA |
- Filr – Secure document library VendorUnknown Affected 1.2.2.1 to before 1.2.2.1 Fixed in 1.2.2.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:filr_project:filr:*:*:*:*:*:wordpress:*:* | before 1.2.2.1 | Vulnerable | Filr Project |
- cpe:2.3:a:filr_project:filr:*:*:*:*:*:wordpress:*:* Versions before 1.2.2.1 Vulnerable ·Filr Project
Remediation
- Fix · CNA Filr – Secure document library (Unknown) Fixed in 1.2.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1777
- 2026-10-03 Alias added: GHSA-9hjh-mf35-j3ff
References
More Filr Project Filr vulnerabilities
- TI-2023-05300 Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext CVSS 3.1HIGH 8.8
Sources
- CVE-2022-1777 · CVE Program
- CVE-2022-1777 · NVD
- FIRST EPSS
- GHSA-9hjh-mf35-j3ff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences