Vulnerability · Published Jan 18, 2022 · Assigned by Wordfence
CVE-2022-0236WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure
High 7.5
In plain English
A high-severity missing authorization in WP Import Export from vjinfotech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vjinfotech | WP Import Export | 3.9.15 – through 3.9.15 |
| vjinfotech | WP Import Export Lite | 3.9.15 – through 3.9.15 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N