CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
Explanation of Vulnerability in Simple Terms
The Import Export WordPress Users plugin through version 2.5.2 contains a path traversal vulnerability in file handling. An authenticated user with low privileges can read arbitrary files from the server by manipulating file paths during import or export operations. This allows access to sensitive configuration files and other non-public data stored on the web server.
What an attacker can do
Read arbitrary files from the server, including configuration files and other sensitive data.
Potential impact on your site
Sensitive files like wp-config.php, database backups, or private user data could be exposed to authenticated users.
Conditions required to exploit
Attacker must have a WordPress user account with at least low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
