CVE-2024-5637

HIGH

WordPress Market Exporter <2.0.19 - Info Disclosure

Title source: llm

Description

The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server.

Exploits (1)

github WORKING POC 3 stars

by certuscyber · pythonpoc

https://github.com/certuscyber/cve-pocs/tree/main/CVE-2024-5637

View Code ZIP pw:eip

References (3)

[Product] https://plugins.trac.wordpress.org/browser/market-exporter/trunk/includes/class-restapi.php#L427

[Patch] https://plugins.trac.wordpress.org/changeset/3098360/market-exporter/trunk/includes/class-restapi.php

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ea4bf9-e109-465e-890a-c2923089fb66?source=cve

Scores

CVSS v3 7.5

EPSS 0.0581

EPSS Percentile 90.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-22 CWE-862

Status published

Products (2)

vanyukov/Market Exporter < 2.0.19

vanyukov/market_exporter < 2.0.20

Published Jun 07, 2024

Tracked Since Feb 18, 2026