CVE-2022-3394
WP All Export Pro < 1.7.9 - Authenticated Code Injection
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.2EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
25 oct 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · WP All Export Pro¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →