CVE-2022-0236
Published: 18 January 2022
Summary
CVE-2022-0236 is a high-severity Missing Authorization (CWE-862) vulnerability in Vjinfotech Wp Import Export. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The WP Import Export WordPress plugin, in both free and premium editions up to version 3.9.15, contains a missing capability check in the wpie_process_file_download function within includes/classes/class-wpie-general.php. This flaw permits unauthenticated access to arbitrary imported or exported files stored by the plugin, exposing sensitive data such as user records. The issue is tracked as CWE-862 and carries a CVSS 3.1 score of 7.5 reflecting network-exploitable confidentiality impact without authentication or user interaction.
An unauthenticated attacker can directly invoke the download function with crafted parameters to retrieve any previously processed import or export files present on the site. Successful exploitation yields the full contents of those files, which may include personal information or other confidential records collected during normal plugin operation.
Public references, including the Wordfence advisory and the WordPress plugin repository changeset 2649762, indicate that the vendor addressed the missing authorization check in subsequent releases; site administrators are advised to update the plugin to a patched version. A proof-of-concept is also available on GitHub demonstrating the unauthenticated file retrieval path.
The associated EPSS score has remained flat at its peak value of 0.3739 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15431
Vulnerability details
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated…
more
attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.