Description
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Export any WordPress data to XML/CSV | < 1.4.0 | 1.4.0 |
| — | WP All Export Pro | < 1.8.6 | 1.8.6 |
References
- https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f exploit vdb-entry technical-description