CVE-2023-5882 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
Attackers can exploit CSRF to force logged-in users to trigger actions leading to remote code execution in WP All Export plugins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-5882?
CVE-2023-5882 is a high-severity vulnerability in Unknown Export any WordPress data to XML/CSV, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
Weakness: CWE-352
Which versions are affected by CVE-2023-5882?
It affects 2 products.
Products include Soflyy Export Any Wordpress Data to Xml\/Csv, Soflyy Wp All Export.
How do I fix CVE-2023-5882?
No fix has been published for CVE-2023-5882 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5882 exists.
Other vulnerabilities in Unknown Export any WordPress data to XML/CSV
- CVE-2023-5886 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF
- CVE-2023-7082 WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
- CVE-2023-4724 WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE
- CVE-2022-1800 Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection
Sources
Also known as GHSA-7xp2-7hw7-rv8q.