CVE-2023-4724
Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Authenticated (Admin+) Remote Code Execution
mediumImproper Control of Generation of Code ('Code Injection')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
1.4.1
Patched in
60d
Time to patch
Description
The Export any WordPress data to XML/CSV plugin for WordPress is vulnerable to Remote Code Execution in versions up to 1.4.1, and in versions up to 1.8.6 in the PRO version via the 'wp_query' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:HAttack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
High
Confidentiality
High
Integrity
High
Availability
Technical Details
Affected versions
<1.4.1PublishedNovember 24, 2023
Last updatedJanuary 22, 2024
Affected pluginwp-all-export
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.