Vulnerability · Published Jan 15, 2024 · Assigned by WPScan
CVE-2023-5905DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export
High 8.1
In plain English
A high-severity security flaw in DeMomentSomTres WordPress Export Posts With Images from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | DeMomentSomTres WordPress Export Posts With Images | 0 – through 20220825 |
References
- https://wpscan.com/vulnerability/f94e91ef-1773-476c-9945-37e89ceefd3f exploit, vdb-entry, technical-description