WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

CVE-2023-5886

What is CVE-2023-5886?

A vulnerability exists in the Export any WordPress data to XML/CSV plugin and WP All Export Pro plugin due to insufficient nonce verification in the request lifecycle. Attackers capable of uploading files can initiate unauthorized actions on behalf of logged-in users. This exploitation may result in PHAR deserialization, which could lead to the execution of arbitrary code remotely, facilitating severe impacts on the affected WordPress installations.

References