CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.1.
Explanation of Vulnerability in Simple Terms
WP Ultimate Exporter versions 2.9.1 and earlier contain a code injection vulnerability that allows high-privilege users to execute arbitrary PHP code on the site. An attacker with administrator or equivalent access can inject malicious code through the plugin's functionality, affecting confidentiality, integrity, and availability of the entire WordPress installation.
What an attacker can do
Run arbitrary PHP code on the site with full system privileges.
Potential impact on your site
A compromised admin account can execute code to steal data, modify content, or disable the site entirely.
Conditions required to exploit
Attacker must have high-level WordPress privileges (administrator or equivalent role).
Key dates
External resources
Related vulnerabilities
