CVE-2023-3459highCWE-863

CVE-2023-3459: falha de alta gravidade em webtoffee Export and Import Users and Customers

Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Export and Import Users and Customers

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.9%
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
webtoffee · Export and Import Users and Customers
CVEs relacionadas — webtoffee Export and Import Users and Customers

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6558HIGHExport and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File UploadEPSS 1.4%CVE-2025-1971HIGHExport and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data ParameterEPSS 0.8%CVE-2025-1973MEDIUMExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file FunctionEPSS 0.7%CVE-2025-1970HIGHExport and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file FunctionEPSS 0.4%CVE-2025-1972LOWExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2026-104368HIGHExport and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info FieldEPSS 0.3%