Unauthorized Data Access in Export Import Menus Plugin for WordPress
CVE-2024-10866

5.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Export Import Menus
Vendor
CVE Published:
7 January 2025

What is CVE-2024-10866?

The Export Import Menus plugin for WordPress has a security flaw that allows unauthorized users to access and export sensitive menu data and settings. This vulnerability arises from a missing capability check in the dsp_export_import_menus() function, affecting all versions up to and including 1.9.1. As a result, unverified attackers can exploit this weakness to gain access to confidential information without proper authentication, posing a significant risk to the integrity of WordPress websites.

Affected Version(s)

Export Import Menus * <= 1.9.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

BrokenAC ignore
.
CVE-2024-10866 : Unauthorized Data Access in Export Import Menus Plugin for WordPress