Unauthorized Data Loss in Market Exporter for WordPress Due to Missing Capability Check

CVE-2024-5637

Summary

The Market Exporter plugin for WordPress contains a vulnerability that allows authenticated users to execute unauthorized file deletions. This issue arises from a missing capability check on the 'remove_files' function, impacting all versions up to and including 2.0.19. Attackers with Subscriber-level access and higher can exploit this flaw through path traversal techniques to remove arbitrary files from the server, potentially leading to data loss and disruption of service.

References