CVE-2024-7514
MEDIUMWordPress Comments Import & Export <2.3.7 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-7514. PoCs published by RandomRobbieBF.
AI-analyzed exploit summary This PoC demonstrates an authenticated arbitrary file read vulnerability in the WordPress Comments Import & Export plugin via directory traversal. The exploit leverages insufficient file path validation during the comments import process, allowing attackers with Author-level access to read arbitrary files.
Description
The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The issue was partially fixed in version 2.3.8 and fully fixed in 2.3.9
Exploits (1)
This PoC demonstrates an authenticated arbitrary file read vulnerability in the WordPress Comments Import & Export plugin via directory traversal. The exploit leverages insufficient file path validation during the comments import process, allowing attackers with Author-level access to read arbitrary files.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N