CVE-2023-5882

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

published December 18, 2023

CVSS
—
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Published
2023-12-18T20:08Z
EPSS history
Timeline
  • 18 DEC 20:08Z
    WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
    cvelistv5