WordPress Export All Posts, Products, Orders, Refunds & Users Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Export All Posts, Products, Orders, Refunds & Users plugin, affecting all versions through 2.19. The vulnerability arises from inadequate nonce validation in the 'parseData' function, allowing unauthenticated attackers to exploit the flaw. By tricking a site administrator into clicking a link, an attacker could export sensitive information such as user data, email addresses, password hashes, and WooCommerce data to a file path controlled by the attacker on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access and export of sensitive user information, including email addresses, password hashes, and WooCommerce data, to an attacker-controlled location on the server.

Remediation

Users are advised to update the WordPress Export All Posts, Products, Orders, Refunds & Users plugin to version 2.20 or later.