The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| webtoffee | Export and Import Users and Customers | ≤ 2.6.2 | |
| webtoffee | import export wordpress users | < 2.6.3 |
cpe:2.3:a:webtoffee:import_export_wordpress_users:*:*:*:*:*:wordpress:*:* < 2.6.3Dos herramientas gratuitas, una sola defensa: el Sensor detecta a quien sondea su servidor; Shield detiene a los atacantes conocidos antes de que lleguen a su sitio.
Instálelo y su cuota diaria de API sube a 30.000 consultas, sin solicitudes.