PT-2023-24936 · WordPress · Export/Import Users/Customers
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Export and Import Users and Customers plugin for WordPress versions up to, and including, 2.4.1
Description
The issue is related to a missing capability check on the
hf update customer function, which is called via an AJAX action. This allows authenticated attackers with shop manager-level permissions to modify user data, including changing user passwords, potentially leading to the takeover of administrator accounts.Recommendations
For versions up to, and including, 2.4.1, consider disabling the
hf update customer function until a patch is available to prevent unauthorized modification of user data. Restrict access to the AJAX action that calls the hf update customer function to minimize the risk of exploitation.Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Export/Import Users/Customers