CVE-2022-0236: vjinfotech wp import export +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-0236

CVSS 7.5 · High EPSS 4,3%

Kerentanan Missing Authorization pada vjinfotech wp import export, vjinfotech wp import export lite. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.

Rincian

Terbit di NVD: 18 Januari 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 4,3% peluang dieksploitasi; lebih tinggi dari 90,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
vjinfotech	wp import export	Semua versi hingga 3.9.15
vjinfotech	wp import export lite	Semua versi hingga 3.9.15

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-g... patch · advisory pihak ketiga
https://github.com/qurbat/CVE-2022-0236 exploit · advisory pihak ketiga
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0236 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.