WordPress Plugin Vulnerabilities

Export Import Menus < 1.9.2 - Missing Authorization to Unauthenticated Menu Export

Description

The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() function in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to export menu data and settings.

Affects Plugins

Plugin icon
export-import-menus
Fixed in 1.9.2

References

CVE
CVE-2024-10866
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/08beb583-096d-453c-9690-b46e410afb1b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
BrokenAC ignore
Verified
No
WPVDB ID
be187cd5-0079-4b41-a588-bb2a177a3fc6

Timeline

Publicly Published
2025-01-06 (about 1 year ago)
Added
2025-01-06 (about 1 year ago)
Last Updated
2025-01-07 (about 1 year ago)

Other

Published
Title
Published
2026-09-18
Title
Flex Import < 3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions
Published
2025-12-15
Title
Image Gallery – Photo Grid & Video Gallery < 2.13.4 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification
Published
2026-01-26
Title
Subscribe <= 1.2.16 - Missing Authorization
Published
2025-10-02
Title
Jock On Air Now (JOAN) < 6.0.5 - Missing Authorization
Published
2026-08-31
Title
Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk