VULNERABILITY INTELLIGENCE

CVE-2022-3394

CVSS score7.2 HIGH
EPSS probability2.02%
CISA KEVNot currently listed
Published2022-10-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.

Weakness classification

  • contact@wpscan.com: CWE-94

Primary references