PT-2023-32392 · WordPress · Export Any Wordpress Data To Xml/Csv+1

Ddipa + 3 · Published 2023-12-18 · Updated 2023-12-21 · CVE-2023-5882

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0 WP All Export Pro WordPress plugin versions prior to 1.8.6

Description The issue allows attackers to make logged-in users perform unwanted actions, leading to remote code execution. This is due to the plugins not checking nonce tokens early enough in the request lifecycle.

Recommendations For Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0, update to version 1.4.0 or later. For WP All Export Pro WordPress plugin versions prior to 1.8.6, update to version 1.8.6 or later.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-5882

Affected Products

Export Any Wordpress Data To Xml/Csv

Wp All Export Pro

References · 5

• 🔥 https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2 · Exploit
• https://osv.dev/vulnerability/CVE-2023-5882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5882 · Security Note
• https://twitter.com/CVEnew/status/1736842762765394356 · Twitter Post
• https://t.me/cvenotify/64741 · Telegram Post