CVE-2022-0236 - CVE House

Back to Database

Status published High CVE-2022-0236

WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure

7.5 CVSS

Vulnerability Description

The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-0236

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Karan Saini (Kloudle Inc.)

References

More from vjinfotech

View All →

WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload

WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

Affected Vendor

vjinfotech

View all reports →

Affected Software

WP Import Export, WP Import Export Lite

Vulnerable Versions:

3.9.15

Timeline

Official Publish: January 18th, 2022

Last Modified: January 31st, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal