CVE-2022-2943 in Ajax Load More Plugin
Summary
by MITRE • 09/06/2022
The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/08/2026
The vulnerability identified as CVE-2022-2943 affects the WordPress Infinite Scroll – Ajax Load More plugin, specifically impacting versions up to and including 5.5.3. This security flaw resides within the alm_repeaters_export() function which fails to properly validate file paths, creating a critical arbitrary file reading vulnerability. The flaw represents a significant security weakness that directly violates the principle of least privilege and proper input validation, as outlined in CWE-22 which addresses improper limitation of a pathname to a restricted directory. Attackers with administrative privileges can exploit this vulnerability to access sensitive files stored on the WordPress server, potentially compromising the entire web application infrastructure.
The technical implementation of this vulnerability stems from inadequate sanitization of user-supplied input within the alm_repeaters_export() function. When an authenticated administrator invokes the export functionality, the plugin fails to properly validate or sanitize the file path parameter, allowing malicious input to traverse the file system and access unintended files. This weakness directly enables path traversal attacks, a well-documented vulnerability pattern that falls under CWE-91. The specific exploitation vector allows attackers to request arbitrary files through the plugin's export mechanism, with the wp-config.php file being a primary target due to its inclusion of database credentials, secret keys, and other sensitive configuration data that could lead to complete system compromise.
The operational impact of this vulnerability extends beyond simple data exposure, as it provides attackers with the capability to extract critical system information that could facilitate further attacks. Access to wp-config.php exposes database connection details, cryptographic keys, and other sensitive configuration parameters that could enable attackers to escalate privileges, perform database injection attacks, or even gain access to additional systems within the network. This vulnerability particularly threatens WordPress installations that rely on the affected plugin, as it creates an attack surface that bypasses normal authentication boundaries and allows for internal reconnaissance. The risk is amplified by the fact that the vulnerability requires only administrative privileges, which are often more easily compromised than system-level access, making it a particularly dangerous weakness in WordPress security architectures.
Organizations should immediately implement mitigations including updating to the patched version of the Ajax Load More plugin, applying the official security patch released by the plugin developers, and conducting comprehensive security audits of their WordPress installations. System administrators should also consider implementing additional security controls such as restricting file permissions on sensitive configuration files, implementing web application firewalls with custom rules to detect and block path traversal attempts, and establishing monitoring for unusual file access patterns. The vulnerability demonstrates the importance of proper input validation and output encoding practices as recommended by the OWASP Top Ten and aligns with ATT&CK technique T1213 which covers data from information repositories. Regular security assessments and vulnerability scanning should be performed to identify similar weaknesses in other plugins and themes, as this vulnerability represents a common pattern that may exist in other WordPress components.