CVE-2024-12315
Last modified
CVE-2024-12315 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Smackcoders | Export All Posts\, Products\, Orders\, Refunds \& Users | < 2.10 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-12315?
How severe is CVE-2024-12315?
How do I fix CVE-2024-12315?
Are you affected by CVE-2024-12315?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST