CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Explanation of Vulnerability in Simple Terms
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress contains an information exposure vulnerability in versions up to 2.4.1. An attacker can read sensitive data without authentication by exploiting a flaw in access controls. The vulnerability requires specific conditions to trigger but can expose user information, order details, and other exported data. Update to a version newer than 2.4.1 to resolve this issue.
What an attacker can do
Read sensitive exported data including user information, orders, and products without logging in.
Potential impact on your site
User data, customer orders, and product information may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the site; no authentication required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
