CVE-2022-0236

ÉLEVÉE 7.5CVE-2022-0236 · Published 18/01/2022 · updated 17/06/2026

En bref

CVE-2022-0236 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant wp import export (vjinfotech), wp import export lite (vjinfotech).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.3%, plus élevée que 91.1% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
wp import export vjinfotech	`≤ 3.9.15`	No fix yet
wp import export lite vjinfotech	`≤ 3.9.15`	No fix yet

Description

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.

References

qurbat/CVE-2022-0236 · Exploit
plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.php · Patch
wordfence.com/vulnerability-advisories · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free