CVE-2024-12315
Last modified
CVE-2024-12315 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Smackcoders | Export All Posts\, Products\, Orders\, Refunds \& Users | < 2.10 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-12315?
How severe is CVE-2024-12315?
How do I fix CVE-2024-12315?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-1231The CM Download Manager WordPress plugin before 2.9.0 does …6.8
- CVE-2024-12310A vulnerability in Imprivata Enterprise Access Management (f…7
- CVE-2024-12311The Email Subscribers by Icegram Express WordPress plugin b…6.5
- CVE-2024-12312The Print Science Designer plugin for WordPress is vulnerabl…8.1
- CVE-2024-12313The Compare Products for WooCommerce plugin for WordPress is…8.1
- CVE-2024-12314The Rapid Cache plugin for WordPress is vulnerable to Cache …7.2
- CVE-2024-12316The Jupiter X Core plugin for WordPress is vulnerable to una…5.3
- CVE-2024-1232The CM Download Manager WordPress plugin before 2.9.0 does …4.8
- CVE-2024-12320The Team Rosters plugin for WordPress is vulnerable to Refle…6.1
- CVE-2024-12321The WC Affiliate WordPress plugin through 2.3.9 does not sa…7.1
- CVE-2024-12322The ThePerfectWedding.nl Widget plugin for WordPress is vuln…8.8
- CVE-2024-12323The turboSMTP plugin for WordPress is vulnerable to Reflecte…6.1
Are you affected by CVE-2024-12315?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST