Vulnerability · Published Oct 25, 2022 · Assigned by WPScan
CVE-2022-3394WP All Export Pro < 1.7.9 - Authenticated Code Injection
High 7.2
In plain English
A high-severity code injection in WP All Export Pro from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.0%top 19.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP All Export Pro | 1.7.9 – before 1.7.9 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H