Import and export users and customers, CVE-2024-1050

CVE, Research URL: CVE-2024-1050
Home page URL: Security reports for Import and export users and customers
Application: Import and export users and customers
Published on: May 04, 2024
Research Description: The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets.
Affected versions: max 1.26.6.
Status: vulnerable