Export and Import Users and Customers, CVE-2023-6558

CVE, Research URL: CVE-2023-6558
Home page URL: Security reports for Export and Import Users and Customers
Application: Export and Import Users and Customers
Published on: Jan 11, 2024
Research Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected versions: Min -, max 2.4.9.
Status: vulnerable