Description
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WholesaleX | < 3.0.9 | 3.0.9 |
References
- https://wpscan.com/vulnerability/cc30caa4-4d55-4c22-a81c-ae4acf1b99bd/ exploit vdb-entry technical-description