PT-2023-32395 · WordPress · Export Any Wordpress Data To Xml/Csv+1

Alex Sanford · Publicado 2023-12-18 · Atualizado 2023-12-21 · CVE-2023-5886

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0 WP All Export Pro WordPress plugin versions prior to 1.8.6

Description The issue arises from the failure to check nonce tokens early enough in the request lifecycle, allowing attackers with file upload capabilities to make logged-in users perform unwanted actions. This can lead to PHAR deserialization, potentially resulting in remote code execution.

Recommendations For Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0, update to version 1.4.0 or later. For WP All Export Pro WordPress plugin versions prior to 1.8.6, update to version 1.8.6 or later.

Exploit

Correção

RCE

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-5886

Produtos afetados

Export Any Wordpress Data To Xml/Csv

Wp All Export Pro

Referências · 5

• 🔥 https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 · Exploit
• https://t.me/cvenotify/64742 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1736842771879612695 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5886 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-5886 · Nota de Segurança