CVE-2023-6583 - Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality

Back Back to CVE browser

HIGH

Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality

Published Jan 11, 2024

7.2

HIGH

CVSS 3.1

EPSS 0.80%

Description

The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.

Affected products

Vendor Carazo Product Import and export users and customers Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.24.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Carazo

Import and export users and customers

unaffected

Version	Status	Constraints
0	affected	<=1.24.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-22

Path Traversal

CWE-98

References (2)

https://plugins.trac.wordpress.org/changeset/3007057/
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve
Third Party Advisory

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset/3007057/		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve		Third Party Advisory