CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.
Explanation of Vulnerability in Simple Terms
Export All Posts, Products, Orders, Refunds & Users versions 2.9.3 and earlier contain an information disclosure vulnerability. An attacker can read sensitive data without authentication or user interaction. The vulnerability stems from improper access controls on data export functionality. Site administrators should update to a version newer than 2.9.3 immediately.
What an attacker can do
Read sensitive site data including posts, products, orders, refunds, and user information without logging in.
Potential impact on your site
Attackers can download your site's database exports containing customer data, orders, and user details without permission.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
