7.5

CVE-2022-0236

Exploit

WP Import Export Lite & WP Import Export <= 3.9.15 - Unauthenticated Sensitive Data Disclosure

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Mögliche Gegenmaßnahme
WP Import Export Lite: Update to version 3.9.16, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP Import Export Lite
Version * - 3.9.15
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vjinfotech ≫ Wp Import Export SwPlatformwordpress Version <= 3.9.15
Vjinfotech ≫ Wp Import Export Lite SwPlatformwordpress Version <= 3.9.15
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 37.39% 0.968
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
security@wordfence.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/qurbat/CVE-2022-0236
Third Party Advisory
Exploit