WordPress Plugin Vulnerabilities

Export and Import Users and Customers < 2.4.9 - Shop Manager+ Arbitrary File Upload

Description

The plugin does not properly check uploaded files via the upload_import_file() function, allowing users with the Shop Manager role and above to upload arbitrary files

Affects Plugins

Plugin icon
users-customers-import-export-for-wp-woocommerce
Fixed in 2.4.9

References

CVE
CVE-2023-6558
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/55b3e2dc-dc4f-408b-bbc6-da72ed5ad245

Miscellaneous

Original Researcher
István Márton
Verified
No
WPVDB ID
ba72480e-326d-4d4c-8251-0f27cfeb6453

Timeline

Publicly Published
2023-12-12 (about 2 years ago)
Added
2023-12-13 (about 2 years ago)
Last Updated
2023-12-13 (about 2 years ago)

Other

Published
Title
Published
2024-10-14
Title
WordPress Gallery Plugin – Limb Image Gallery <= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-05-10
Title
Z-Downloads < 1.11.4 - Authenticated (Admin+) Arbitrary File Upload
Published
2024-05-07
Title
AI Engine: ChatGPT Chatbot < 2.2.70 - Authenticated (Editor+) Arbitrary File Upload
Published
2014-11-25
Title
Gallery Bank <= 3.0.60 - Shell Upload
Published
2024-05-13
Title
Kognetiks Chatbot for WordPress < 2.0.1 - Unauthenticated Arbitrary File Upload