Is CVE-2022-50954 actively exploited?

No active exploitation of CVE-2022-50954 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-50954 be exploited remotely?

No. CVE-2022-50954 requires local access to exploit.

What is the CVSS score of CVE-2022-50954?

CVE-2022-50954 has a CVSS score of 6.2 (MEDIUM).

HOME VULNERABILITIESCVE-2022-50954

MEDIUM

CVE-2022-50954

CWE-98Published: May 10, 2026· Updated: May 12, 2026

6.2

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.6th

Official Description

WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the controller parameter in tblight.php. Attackers can supply path traversal sequences through the controller GET parameter to include and execute files outside the intended controllers directory.

NVD Source

Technical Analysis

CVE-2022-50954 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.2.