Lucene search

WordfenceCVE-2023-6558

HistoryJan 11, 2024 - 9:15 a.m.

CVE-2023-6558

2024-01-1109:15:49

CWE-434

Wordfence

web.nvd.nist.gov

wordpress

export

import

users

customers

plugin

vulnerability

cve-2023-6558

file upload

remote code execution

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the ‘upload_import_file’ function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.

Affected configurations

Nvd

Vulners

Node

webtoffeeimport_export_wordpress_usersRange≤2.4.8wordpress

VendorProductVersionCPE
webtoffeeimport_export_wordpress_users*cpe:2.3:a:webtoffee:import_export_wordpress_users:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
webtoffee	import_export_wordpress_users	*	cpe:2.3:a:webtoffee:import_export_wordpress_users::::::wordpress::*

CNA Affected

[
  {
    "vendor": "webtoffee",
    "product": "Export and Import Users and Customers",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.4.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.4.7/admin/modules/import/classes/class-import-ajax.php#L124

plugins.trac.wordpress.org/changeset/3008454/users-customers-import-export-for-wp-woocommerce#file197

www.wordfence.com/threat-intel/vulnerabilities/id/55b3e2dc-dc4f-408b-bbc6-da72ed5ad245?source=cve

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

Related for CVE-2023-6558