PT-2023-32395 · WordPress · Export Any Wordpress Data To Xml/Csv+1

Alex Sanford · Published 2023-12-18 · Updated 2023-12-21 · CVE-2023-5886

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0 WP All Export Pro WordPress plugin versions prior to 1.8.6

Description The issue arises from the failure to check nonce tokens early enough in the request lifecycle, allowing attackers with file upload capabilities to make logged-in users perform unwanted actions. This can lead to PHAR deserialization, potentially resulting in remote code execution.

Recommendations For Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0, update to version 1.4.0 or later. For WP All Export Pro WordPress plugin versions prior to 1.8.6, update to version 1.8.6 or later.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-5886

Affected Products

Export Any Wordpress Data To Xml/Csv

Wp All Export Pro

References · 5

• 🔥 https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-5886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5886 · Security Note
• https://t.me/cvenotify/64742 · Telegram Post
• https://twitter.com/CVEnew/status/1736842771879612695 · Twitter Post