PT-2023-32392 · WordPress · Export Any Wordpress Data To Xml/Csv+1

Ddipa + 3 · Publicado 2023-12-18 · Atualizado 2023-12-21 · CVE-2023-5882

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0 WP All Export Pro WordPress plugin versions prior to 1.8.6

Description The issue allows attackers to make logged-in users perform unwanted actions, leading to remote code execution. This is due to the plugins not checking nonce tokens early enough in the request lifecycle.

Recommendations For Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0, update to version 1.4.0 or later. For WP All Export Pro WordPress plugin versions prior to 1.8.6, update to version 1.8.6 or later.

Exploit

Correção

RCE

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-5882

Produtos afetados

Export Any Wordpress Data To Xml/Csv

Wp All Export Pro

Referências · 5

• 🔥 https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2 · Exploit
• https://osv.dev/vulnerability/CVE-2023-5882 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1736842762765394356 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5882 · Nota de Segurança
• https://t.me/cvenotify/64741 · Publicação no Telegram