CVE-2024-7514

🗓️ 11 Oct 2024 08:30:45Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

WordPress Comments Import & Export plugin <= 2.3.7 - Authenticated Arbitrary File Rea

Reporter	Title	Published	Views	Family All 9
GithubExploit	Exploit for CVE-2024-7514	11 Oct 202410:43	–	githubexploit
CNNVD	WordPress plugin Comments Import & Export 路径遍历漏洞	11 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-7514 WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal	11 Oct 202408:30	–	cvelist
NVD	CVE-2024-7514	11 Oct 202413:15	–	nvd
Patchstack	WordPress WordPress Comments Import & Export Plugin <= 2.3.7 is vulnerable to Directory Traversal	10 Oct 202400:00	–	patchstack
Patchstack	WordPress WordPress Comments Import & Export plugin <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal vulnerability	10 Oct 202420:28	–	patchstack
RedhatCVE	CVE-2024-7514	23 May 202510:43	–	redhatcve
Vulnrichment	CVE-2024-7514 WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal	11 Oct 202408:30	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (October 7, 2024 to October 13, 2024)	17 Oct 202415:27	–	wordfence

Vulners

Node

webtoffee wordpress_comments_import_and_exportRange≤2.3.7wordpress

[
  {
    "vendor": "webtoffee",
    "product": "Comments Import & Export",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.3.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/30a79974-ee61-4764-8864-89659b1848a4
plugins	www.plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/tags/2.3.7/includes/importer/class-hf_cmt_impexpcsv-import.php

Parameter	Position	Path	Description	CWE
file	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22
wt_nonce	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22
mapping	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22
profile	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22
eval_field[0]	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22
start_pos	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22
end_pos	request body	wp-admin/admin-ajax.php	Authenticated arbitrary file read via directory traversal in Comments Import & Export plugin	CWE-22

17 Jun 2026 08:20Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.16.5

EPSS0.01039

SSVC

CWE-22