CVE-2022-3394
Last modified
CVE-2022-3394 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.. EPSS estimates a 1.31% chance of exploitation in the next 30 days.
Description
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Soflyy | Wp All Export | < 1.7.9 |
References
- https://wpscan.com/vulnerability/3266eb59-a8b2-4a5a-ab48-01a9af631b2cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/3266eb59-a8b2-4a5a-ab48-01a9af631b2cExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3394?
How severe is CVE-2022-3394?
How do I fix CVE-2022-3394?
Are you affected by CVE-2022-3394?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST