CVE-2022-38061 MEDIUM

CVE-2022-38061: WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

Vendor Apasionados
Product Export Post Info (WordPress plugin)
Published September 23, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Export Post Info WordPress plugin version 1.2.0 and earlier contains a cross-site request forgery (CSRF) vulnerability that allows an authenticated attacker with high privileges to modify site content. The vulnerability requires user interaction—the victim must visit a malicious page while logged in. The impact extends beyond the plugin itself, affecting the integrity of exported post data and potentially other site functions.

What an attacker can do

03Attacker Capabilities

Modify or corrupt exported post information on the site through a forged request.

Potential impact on your site

04Site Impact

An admin or high-privilege user could unknowingly trigger changes to post exports or related data by visiting a compromised page.

Conditions required to exploit

05Prerequisites

Attacker must be authenticated with high-level privileges; victim must click a malicious link while logged in.

Key dates

06Disclosure timeline

September 23, 2022 CVE published
April 28, 2026 Record updated