| Package | Affected versions | Patched versions |
|---|---|---|
| wp import export | ≤ 3.9.15 | |
| wp import export lite | ≤ 3.9.15 |
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free