PT-2021-15977 · WordPress · Export Users With Meta

Asif Nawaz Minhas · Published 2021-07-06 · Updated 2021-07-09 · CVE-2021-24451

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Export Users With Meta WordPress plugin versions prior to 0.6.5

Description The issue concerns an authenticated SQL Injection in the export functionality of the plugin, which is available to admins. This occurs because the list of roles to export is not properly escaped before being used in a SQL statement.

Recommendations For versions prior to 0.6.5, update to version 0.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the export functionality to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24451

Affected Products

Export Users With Meta

References · 5

• 🔥 https://wpscan.com/vulnerability/40603382-404b-44a2-8212-f2008366891c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24451 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24451 · Vendor Advisory
• https://t.me/cvenotify/17351 · Telegram Post
• https://t.me/cvenotify/17109 · Telegram Post