PT-2026-94169 · WordPress · Comments Import & Export
CVSS v3.1
2.7
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Comments Import & Export versions prior to 2.5.4
Description
The plugin fails to restrict the comment export feature to users with comment moderation privileges and does not limit the export to content owned by the requesting user. This allows users with the Author role or higher to retrieve all comments on the site, including commenter email addresses, IP addresses, unapproved comment content, and comment meta.
Recommendations
Update to version 2.5.4 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Comments Import & Export