CVE-2023-5905 DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export

2024-01-1515:10:43

WPScan

www.cve.org

cve-2023-5905

wordpress

export posts

unauthorized

data export

restricted

unpublished

passwords

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.6%

JSON

The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "DeMomentSomTres WordPress Export Posts With Images",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "20220825"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]