WordPress Plugin Vulnerabilities

Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

Description

The plugin does not prevent directory listing in sensitive directories containing export files.

Proof of Concept

Affects Plugins

Plugin icon
prime-mover
Fixed in 1.9.3

References

CVE
CVE-2023-6505
URL
https://research.cleantalk.org/cve-2023-6505-prime-mover-poc-exploit/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
eca6f099-6af0-4f42-aade-ab61dd792629

Timeline

Publicly Published
2023-11-24 (about 2 years ago)
Added
2023-12-12 (about 2 years ago)
Last Updated
2023-12-13 (about 2 years ago)

Other

Published
Title
Published
2024-11-22
Title
Wp Maximum Upload File Size < 1.1.4 - Authenticated (Author+) Full Path Disclosure
Published
2025-12-08
Title
AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Sensitive Information Exposure
Published
2024-07-26
Title
Add Admin CSS < 2.5 - Unauthenticated Full Path Dislcosure
Published
2024-02-08
Title
Passster – Password Protect Pages and Content < 4.2.6.3 - Missing Authorization to Sensitive Information Exposure
Published
2025-09-22
Title
All In One SEO Pack < 4.8.7.2 - Contributor+ Sensitive Information Exposure