The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
References
| Link | Resource |
|---|---|
| https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb | Exploit Third Party Advisory |
| https://seclists.org/fulldisclosure/2015/Jul/73 | Exploit Mailing List Third Party Advisory |
| https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a | Exploit Third Party Advisory |
| https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb | Exploit Third Party Advisory |
| https://seclists.org/fulldisclosure/2015/Jul/73 | Exploit Mailing List Third Party Advisory |
| https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb - Exploit, Third Party Advisory | |
| References | () https://seclists.org/fulldisclosure/2015/Jul/73 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a - Exploit, Third Party Advisory |
Information
Published : 2021-11-01 09:15
Updated : 2024-11-21 02:26
NVD link : CVE-2015-20067
Mitre link : CVE-2015-20067
CVE.ORG link : CVE-2015-20067
JSON object : View
Products Affected
wp_attachment_export_project
- wp_attachment_export
CWE
CWE-862
Missing Authorization