CVE-2023-6558highexploração observadaCWE-434

CVE-2023-6558: falha de alta gravidade em webtoffee Export and Import Users and Customers

Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Export and Import Users and Customers

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

43Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 7.2epss 1.4%
da publicação à arma
Publicada no NVD11 de jan.
VulnCheck+1006d
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
webtoffee · Export and Import Users and Customers
CVEs relacionadas — webtoffee Export and Import Users and Customers

No mesmo produto, das mais perigosas para as menos.

CVE-2023-3459HIGHExport and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password ChangeEPSS 0.9%CVE-2025-1971HIGHExport and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data ParameterEPSS 0.8%CVE-2025-1973MEDIUMExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file FunctionEPSS 0.7%CVE-2025-1970HIGHExport and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file FunctionEPSS 0.4%CVE-2025-1972LOWExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2026-104368HIGHExport and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info FieldEPSS 0.3%