CVEvulnerability
CVE-2015-20067
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-11-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-862
Description
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Affected configurations
• wp attachment export project wp attachment export (< 0.2.4)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb Exploit, Third Party Advisory
- https://seclists.org/fulldisclosure/2015/Jul/73 Exploit, Mailing List, Third Party Advisory
- https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a Exploit, Third Party Advisory
- https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb Exploit, Third Party Advisory
- https://seclists.org/fulldisclosure/2015/Jul/73 Exploit, Mailing List, Third Party Advisory
- https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a Exploit, Third Party Advisory