PT-2024-37654 · WordPress · Userswp

Majdeddine Ben Hadj Brahim · Published 2024-08-03 · Updated 2025-08-22 · CVE-2024-6477

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UsersWP WordPress plugin versions prior to 1.2.12

Description The issue allows unauthenticated attackers to download sensitive information, including IP addresses, usernames, and email addresses, due to the use of predictable filenames when an admin generates an export.

Recommendations For versions prior to 1.2.12, update to version 1.2.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the export functionality until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2024-6477

Affected Products

Userswp

References · 8

• 🔥 https://wpscan.com/vulnerability/346c855a-4d42-4a87-aac9-e5bfc2242b16 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6477 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6477 · Vendor Advisory
• https://t.me/cvenotify/88709 · Telegram Post
• https://twitter.com/oktsec/status/1823528515670524042 · Twitter Post
• https://t.me/cvenotify/124936 · Telegram Post
• https://t.me/cvedetector/2383 · Telegram Post
• https://t.me/cveNotify/133149 · Telegram Post