Comments Import Export
Monthly
A missing authorization vulnerability exists in WebToffee Comments Import & Export for WooCommerce (versions up to 2.4.9) that allows attackers to exploit incorrectly configured access control, potentially enabling unauthorized comment manipulation. The vulnerability is classified as CWE-862 (Missing Authorization), affecting WordPress installations using this plugin. Attackers with low or no privileges may be able to bypass authentication mechanisms to perform unauthorized actions on comment data.
Authenticated WordPress users holding the Author role or above can export every comment stored on a site running the Comments Import & Export plugin before version 2.5.4, because the export routine performs no moderate_comments capability check and does not scope results to the caller's own content. Exposed data includes commenter email addresses, IP addresses, unapproved comment bodies and comment meta. Publicly available exploit code exists, but the weakness is gated behind a valid Author-level credential, so exposure is concentrated on multi-author sites or installations that permit author-level self-registration; the impact is confidentiality-only and bounded.
A missing authorization vulnerability exists in WebToffee Comments Import & Export for WooCommerce (versions up to 2.4.9) that allows attackers to exploit incorrectly configured access control, potentially enabling unauthorized comment manipulation. The vulnerability is classified as CWE-862 (Missing Authorization), affecting WordPress installations using this plugin. Attackers with low or no privileges may be able to bypass authentication mechanisms to perform unauthorized actions on comment data.
Authenticated WordPress users holding the Author role or above can export every comment stored on a site running the Comments Import & Export plugin before version 2.5.4, because the export routine performs no moderate_comments capability check and does not scope results to the caller's own content. Exposed data includes commenter email addresses, IP addresses, unapproved comment bodies and comment meta. Publicly available exploit code exists, but the weakness is gated behind a valid Author-level credential, so exposure is concentrated on multi-author sites or installations that permit author-level self-registration; the impact is confidentiality-only and bounded.