WP All Export Pro < 1.7.9 - Authenticated Code Injection
CVE-2022-3394

7.2HIGH

Key Information:

Vendor

Wordpress
Status
WP All Export Pro
Vendor
CVE Published:
25 October 2022

What is CVE-2022-3394?

The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.

Affected Version(s)

WP All Export Pro 1.7.9

References

https://wpscan.com/vulnerability/3266eb59-a8b2-4a5a-ab48-...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sanjay Das
.
The Cyber Security Vulnerability Database.