Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection

2022-10-1700:00:00

Adel Bouaricha

wpscan.com

0.001 Low

EPSS

Percentile

44.6%

The plugin does not properly escape data when exporting it via CSV files.

Edit your subscriber account’s nickname to: ;=1+3 2) As an administrator, export your users data via http://vulnerable-site.tld/wp-admin/tools.php?page=acui&tab;=export, and open the resulting CSV file in Excel or equivalent software.

CPENameOperatorVersion
import-users-from-csv-with-metalt1.20.5

CPE	Name	Operator	Version
	import-users-from-csv-with-meta	lt	1.20.5

References

plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta

0.001 Low

EPSS

Percentile

44.6%

Related for WPVDB-ID:E3D72E04-9CDF-4B7D-953E-876E26ABDFC6