Unauthorized Data Loss in Market Exporter for WordPress Due to Missing Capability Check

CVE-2024-5637

What is CVE-2024-5637?

The Market Exporter plugin for WordPress contains a vulnerability that allows authenticated users to execute unauthorized file deletions. This issue arises from a missing capability check on the 'remove_files' function, impacting all versions up to and including 2.0.19. Attackers with Subscriber-level access and higher can exploit this flaw through path traversal techniques to remove arbitrary files from the server, potentially leading to data loss and disruption of service.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References