CVE-2023-5886 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF
Attackers can trigger PHAR deserialization via CSRF to achieve remote code execution in WP All Export plugins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-5886?
CVE-2023-5886 is a high-severity unsafe deserialization vulnerability in Unknown Export any WordPress data to XML/CSV, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
Weakness: CWE-352
Which versions are affected by CVE-2023-5886?
It affects 2 products.
Products include Soflyy Export Any Wordpress Data to Xml\/Csv, Soflyy Wp All Export.
How do I fix CVE-2023-5886?
No fix has been published for CVE-2023-5886 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-5886 being exploited?
There is no known exploitation of CVE-2023-5886 in the wild and no public exploit code.
Other vulnerabilities in Unknown Export any WordPress data to XML/CSV
- CVE-2023-5882 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
- CVE-2023-7082 WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
- CVE-2023-4724 WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE
- CVE-2022-1800 Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection
Sources
Also known as GHSA-qgv4-xfrj-hvp7.