Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2022-0236

Published: 18/01/2022 Updated: 24/01/2022
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Vjinfotech

Vulnerability Summary

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated malicious users to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

vjinfotech wp import export

vjinfotech wp import export lite

Github Repositories

https://github.com/qurbat/CVE-2022-0236

Proof of concept for unauthenticated sensitive data disclosure affecting the wp-import-export WordPress plugin (CVE-2022-0236)

CVE-2022-0236 The WP Import Export WordPress plugin is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-generalphp file This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable sit

https://github.com/xiska62314/CVE-2022-0236

CVE-2022-0236

CVE-2022-0236 CVE-2022-0236

References

CWE-862https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.phphttps://www.wordfence.com/vulnerability-advisories/#CVE-2022-0236https://github.com/qurbat/CVE-2022-0236https://nvd.nist.govhttps://github.com/qurbat/CVE-2022-0236
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook