CVE-2023-5882

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
8.8HIGH
EPSS
0.8%
top 26.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Unknown Export ANY Wordpress Data TO Xml/csvUnknown WP ALL Export PROSoflyy Export ANY Wordpress Data TO Xml\/csv+1 more
Timeline
PublishedDec 18

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5unknown/wp_all_export_pro< 1.8.6

🔴Vulnerability Details

2
GHSA
GHSA-7xp2-7hw7-rv8q: The Export any WordPress data to XML/CSV WordPress plugin before 1↗2023-12-18
▶
CVEList
WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF↗2023-12-18
▶
CVE-2023-5882 (HIGH CVSS 8.8) | The Export any WordPress data to XM | cvebase.io