Vulnerability Description
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Webtoffee | Import Export Wordpress Users | <= 1.3.1 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-UsExploitThird Party AdvisoryVDB Entry
- https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0ExploitThird Party Advisory
- https://wpvulndb.com/vulnerabilities/9704Third Party Advisory
- http://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-UsExploitThird Party AdvisoryVDB Entry
- https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0ExploitThird Party Advisory
- https://wpvulndb.com/vulnerabilities/9704Third Party Advisory
FAQ
What is CVE-2019-15092?
CVE-2019-15092 is a vulnerability with a CVSS score of 7.3 (HIGH). The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CS...
How severe is CVE-2019-15092?
CVE-2019-15092 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-15092?
Check the references section above for vendor advisories and patch information. Affected products include: Webtoffee Import Export Wordpress Users.