UsersWP <= 1.2.78 – Users Information Disclosure | CVE 2024-6477 | Plugin Vulnerabilities

Description

The plugin uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

Proof of Concept

After an admin exports user data via `wp-admin/admin.php?page=userswp&tab=import-export)` a CSV file will be saved with the following name:
 
`uwp-users-export-YY-MM-DD-HH-MM.csv` in `/wp-content/uploads/cache/`

Affects Plugins

No known fix

References

CVE

Classification

Type

SENSITIVE DATA DISCLOSURE

OWASP top 10

A3: Sensitive Data Exposure

CWE

CVSS

Miscellaneous

Original Researcher

Majdeddine Ben Hadj Brahim, Souparna Majumder

Submitter

Majdeddine Ben Hadj Brahim, Souparna Majumder

Verified

Yes

WPVDB ID

346c855a-4d42-4a87-aac9-e5bfc2242b16

Timeline

Publicly Published

2024-07-13 (about 2 years ago)

Added

2024-07-13 (about 2 years ago)

Last Updated

2026-10-28 (about 4 hours ago)

Other

Published

Title

Published

2026-04-03

Title

Text to Speech (TTS) by Mementor < 1.9.9 - Unauthenticated Remote Database Access

Published

2026-05-28

Title

Poll Maker by AYS < 6.3.8 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action

Published

2025-12-08

Title

Custom Field Template < 2.7.7 - Authenticated (Subscriber+) Information Exposure

Published

2025-10-20

Title

ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure

Published

2024-08-12

Title

Order Export for WooCommerce < 3.24 - Unauthenticated Sensitive Information Exposure