ByteOS Network

NVD Vulnerability Details :

CVE-2019-15092

Analyzed

Source-cve@mitre.org

Published At-23 Aug, 2019 | 21:15

Updated At-24 Aug, 2020 | 17:37

The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.3	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P

CPE Matches

webtoffee>>import_export_wordpress_users>>Versions up to 1.3.1(inclusive)

cpe:2.3:a:webtoffee:import_export_wordpress_users:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-1236	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-Users-1.3.1-CSV-Injection.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/	cve@mitre.org	Exploit Third Party Advisory
https://wpvulndb.com/vulnerabilities/9704	cve@mitre.org	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History