WordPress Export and Import Users and Customers plugin <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function vulnerability

Directory Traversal to Authenticated Administrator+ Limited Arbitrary File Deletion via adminlogpage Function vulnerability discovered by HayMiz in WordPress Plugin Import Export WordPress Users versions = 2.6.2...

Autodesk: Wordpress users Disclosure

we can see all the WordPress users/author with some of their information. Which can even be Personal information of employees/author. The file author-sitemap.xml at:https://www.payapps.com/author-sitemap.xml is enabled and this give the attacker many users names and emails like: F4036174 Impact...

CVE-2024-9887 Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection

The Login using WordPress Users WP as SAML IDP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

PT-2024-39913

Name of the Vulnerable Software and Affected Versions Login using WordPress Users WP as SAML IDP plugin for WordPress versions up to, and including, 1.15.6 Description The issue is a time-based SQL Injection vulnerability via the id parameter due to insufficient escaping on the user-supplied...

CVE-2024-9887: Improper Neutralization of Special Elements used in an SQL Command

The Login using WordPress Users WP as SAML IDP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

WordPress Login using WordPress Users ( WP as SAML IDP ) plugin <= 1.15.6 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Lesor101 in WordPress Plugin Login using WordPress Users WP as SAML IDP versions = 1.15.6...

WordPress WP Users Masquerade Plugin <= 2.0.0 is vulnerable to Broken Authentication

Software WP Users Masquerade Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9522 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID eb305b8e1a56 Credits Istvá...

CVE-2024-32835

CVE-2024-32835 describes a Deserialization of Untrusted Data vulnerability in the WordPress plugin Export and Import Users and Customers (the plugin name shown as Import Export Users and Customers / Export and Import Users and Customers). Affected versions range from earlier n/a up to 2.5.3. The ...

PT-2024-24910

Name of the Vulnerable Software and Affected Versions WebToffee Import Export WordPress Users versions 2.5.3 and earlier Description The issue is related to the deserialization of untrusted data. This can potentially lead to security issues when untrusted data is processed by the WebToffee Import...

CVE-2024-32835: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3...

CVE-2024-30492

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2...

CVE-2024-30492

CVE-2024-30492 involves an improper restriction (Path Traversal) in the WebToffee Import Export WordPress Users plugin. Publicly stated affected version range is from a non-specified starting point up to 2.5.2. The connected documents reaffirm the path traversal characterization and the affected ...

PT-2024-23418 · WordPress · Webtoffee Import Export Wordpress Users

Name of the Vulnerable Software and Affected Versions: WebToffee Import Export WordPress Users versions through 2.5.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability affects the...

CVE-2024-30492: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2...

Cross site request forgery (csrf)

The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-6390 WordPress Users <= 1.4 - Settings Update via CSRF

The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2024-14950 · WordPress · Wordpress Users

Name of the Vulnerable Software and Affected Versions: WordPress Users WordPress plugin versions 1.4 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

WordPress plugin WordPress Users Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-6390: Cross-Site Request Forgery (CSRF)

The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress WordPress Users Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress Users Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6390 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bb99fc7992d2 Credits Daniel Ruf Required...