CVE-2024-6477 UsersWP < 1.2.12 - Users Information Disclosure

2024-08-0306:00:05

WPScan

www.cve.org

cve-2024-6477

userswp

wordpress

information disclosure

predictable filenames

sensitive information

unauthenticated attackers

security vulnerability

EPSS

Percentile

9.4%

JSON

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "UsersWP",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.2.12"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/346c855a-4d42-4a87-aac9-e5bfc2242b16/

EPSS

Percentile

9.4%

JSON

Related for CVELIST:CVE-2024-6477