CVE-2023-5905
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- demomentsomtres/export posts with images
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/f94e91ef-1773-476c-9945-37e89ceefd3fExploit, Third Party Advisory
- https://wpscan.com/vulnerability/f94e91ef-1773-476c-9945-37e89ceefd3fExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.