Import and export users and customers < 1.24.7 - Missing Authorization via fire_cron REST endpoint

2024-01-2000:00:00

wpscan.com

vulnerability

user data

unauthorized modification

software

rest endpoint

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin is vulnerable to unauthorized modification of data due to an improper capability check on the fire_cron function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to trigger the plugin’s cron job.

CPENameOperatorVersion
eq1.24.7

CPE	Name	Operator	Version
		eq	1.24.7

References

patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-24-6-broken-access-control-vulnerability