Lucene search

Unlock SecurityWPVDB-ID:72BE4B5C-21BE-46AF-A3F4-08B4C190A7E2

HistoryNov 21, 2023 - 12:00 a.m.

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

2023-11-2100:00:00

Unlock Security

wpscan.com

wp all export

remote code execution

csrf

nonce check

vulnerability

wordpress plugin

security

phpinfo()

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.

PoC

Submit the following form as a Super Admin (notice that it does not contain a nonce). Despite the error, visit /wp-admin/admin.php?page=pmxe-admin-export&action;=template to see the output of phpinfo().