CVE-2023-5905

2024-01-1516:15:12

CWE-862

[email protected]

web.nvd.nist.gov

cve

demomentsomtres

wordpress

export

authorization

security

vulnerability

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.6%

JSON

The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.

Affected configurations

Vulners

NVD

Node

webtoffeeimport_export_wordpress_usersRange≤20220825

VendorProductVersionCPE
webtoffeeimport_export_wordpress_users*cpe:2.3:a:webtoffee:import_export_wordpress_users:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
webtoffee	import_export_wordpress_users	*	cpe:2.3:a:webtoffee:import_export_wordpress_users::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "DeMomentSomTres WordPress Export Posts With Images",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "20220825"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]