Description (CNA)
The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / WP Attachment Export | affected 0.2.4 before 0.2.4 |
CWE
CWE-862
References
- https://seclists.org/fulldisclosure/2015/Jul/73
- https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_attachment_export_file_download.rb
- https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a
ADP enrichment
No English description supplied.