CVE-2024-12315

HIGH

Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Sensitive Information Exposure

Title source: llm

Description

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.

References (3)

Core 3

Core References

Product

https://plugins.trac.wordpress.org/browser/wp-ultimate-exporter/trunk/exportExtensions/ExportExtension.php#L1678

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3230400%40wp-ultimate-exporter&new=3230400%40wp-ultimate-exporter&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/075709e0-5f00-4d7b-80f6-96e3b4b4a895?source=cve

Scores

CVSS v3 7.5

EPSS 0.0046

EPSS Percentile 36.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-922

Status published

Products (2)

smackcoders/Export All Posts, Products, Orders, Refunds & Users < 2.9.3

smackcoders/export_all_posts\,_products\,_orders\,_refunds_\&_users < 2.10

Published Feb 12, 2025

Tracked Since Feb 18, 2026