CVE-2024-12637mediumCWE-200

CVE-2024-12637: medium-severity vulnerability in katsushi-kawamori Moving Users

Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure

Published · Updated

Follow this CVE+ Monitor Moving Users

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated attackers to extract sensitive user data, for instance, email addresses, hashed passwords, and IP addresses.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
katsushi-kawamori · Moving Users