CVE Feed

    Dashboard / CVE / CVE-2022-3394

    CVE-2022-3394

    The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.

    Published:Oct 25, 2022
    Last Modified:May 7, 2025
    EPS:Oct 25, 2022
    EPSS Score:0.00524
    CVSS Score:7.2

    Affected Products

    Vendor
    Soflyy
    Product
    Wp All Export

    Exploits

    https://wpscan.com/vulnerability/3266eb59-a8b2-4a5a-ab48-01a9af631b2chttps://wpscan.com/vulnerability/3266eb59-a8b2-4a5a-ab48-01a9af631b2c

    Related CVEs

    CVE-2024-7425 (CVSS 6.8) — The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to…
    CVE-2024-7419 (CVSS 8.3) — The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i…
    CVE-2023-5882 (CVSS 8.8) — The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin bef…
    CVE-2023-4724 (CVSS 7.2) — The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin bef…
    CVE-2023-5886 (CVSS 8.8) — The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin bef…
    CVE-2022-3395 (CVSS 8.8) — The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High