The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Dec 2023, 19:50
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:soflyy:export_any_wordpress_data_to_xml\/csv:*:*:*:*:*:wordpress:*:* cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:* |
|
| References | () https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2 - Exploit, Third Party Advisory | |
| CWE | CWE-352 |
18 Dec 2023, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-18 20:15
Updated : 2024-02-05 00:22
NVD link : CVE-2023-5882
Mitre link : CVE-2023-5882
CVE.ORG link : CVE-2023-5882
JSON object : View
Products Affected
soflyy
- export_any_wordpress_data_to_xml\/csv
- wp_all_export
CWE
CWE-352
Cross-Site Request Forgery (CSRF)