CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows Absolute Path Traversal.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.
Explanation of Vulnerability in Simple Terms
WP Ultimate Exporter versions 2.9 and earlier contain a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server. An attacker with admin privileges can bypass directory restrictions and access sensitive files outside the intended export scope. This affects confidentiality but not integrity or availability.
What an attacker can do
Read arbitrary files from the server filesystem.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts can access sensitive files like configuration files, database backups, or private keys.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
