CVE-2024-5637

Deeper analysis

The Market Exporter plugin for WordPress is vulnerable to unauthorized data loss stemming from a missing capability check on the remove_files function. The flaw affects all versions through 2.0.19 and combines improper authorization (CWE-862) with path traversal (CWE-22), enabling an authenticated caller to supply crafted paths that delete arbitrary files on the underlying server. The issue carries a CVSS 3.1 score of 7.5 with network attack vector and high availability impact.

An authenticated attacker holding Subscriber or higher privileges can invoke the plugin’s REST API endpoint to trigger the unprotected function, resulting in deletion of chosen files without further user interaction. Because the check for administrative capabilities is absent, the attack requires only a valid WordPress account on the target site and does not depend on administrator-level rights.

Public references point to a patched changeset (3098360) in the plugin’s class-restapi.php that restores the missing authorization check, and the Wordfence advisory recommends updating to the fixed release once available. The EPSS score has remained flat at 0.0581 with no material increase after disclosure.