CVEvulnerability

CVE-2023-5886

8.8 HIGH Published 2023-12-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.

Affected configurations

• soflyy export any wordpress data to xml\/csv (< 1.4.1) • soflyy wp all export (< 1.8.6)

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References