CVE-2022-0236 – This vulnerability in the WP Import Export Word... (How to Fix)

📋 TL;DR

This vulnerability in the WP Import Export WordPress plugin allows unauthenticated attackers to download any imported or exported data from vulnerable sites. This can expose sensitive information including user data, passwords, and other confidential content. All WordPress sites using affected plugin versions are at risk.

💻 Affected Systems

Products:

WP Import Export WordPress Plugin (Free and Premium)

Versions: All versions up to and including 3.9.15

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects both free and premium versions. Vulnerability exists in default configuration.

📦 What is this software?

Wp Import Export by Vjinfotech

View all CVEs affecting Wp Import Export →

Wp Import Export Lite by Vjinfotech

View all CVEs affecting Wp Import Export Lite →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete data breach exposing all imported/exported data including user credentials, personal information, and site configuration, potentially leading to account takeover and further compromise.

🟠

Likely Case

Exposure of sensitive user data, configuration files, and potentially administrative credentials stored in exports.

🟢

If Mitigated

Limited impact if no sensitive data has been imported/exported, but plugin functionality remains compromised.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple HTTP request to vulnerable endpoint. Public exploit code available on GitHub.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.9.16 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WP Import Export plugin
4. Click 'Update Now' if available
5. If no update available, download version 3.9.16+ from WordPress repository
6. Deactivate, delete old version, upload and activate new version

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate wp-import-export-lite

Web Application Firewall Rule

linux

Block access to vulnerable endpoint

LocationMatch "\/wp-content\/plugins\/wp-import-export-lite\/includes\/classes\/class-wpie-general\.php"
    Deny from all

🧯 If You Can't Patch

Disable WP Import Export plugin immediately
Implement web application firewall rules to block access to /wp-content/plugins/wp-import-export-lite/includes/classes/class-wpie-general.php

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin panel under Plugins → Installed Plugins. If WP Import Export version is 3.9.15 or lower, site is vulnerable.

Check Version:

wp plugin list --name=wp-import-export-lite --field=version

Verify Fix Applied:

Verify plugin version is 3.9.16 or higher. Test by attempting to access /wp-content/plugins/wp-import-export-lite/includes/classes/class-wpie-general.php?wpie_download=true - should return 403 or similar error.

📡 Detection & Monitoring

Log Indicators:

HTTP requests to /wp-content/plugins/wp-import-export-lite/includes/classes/class-wpie-general.php with wpie_download parameter
Large file downloads from plugin directory by unauthenticated users

Network Indicators:

Unusual spikes in traffic to plugin files
Data exfiltration patterns from WordPress sites

SIEM Query:

source="web_logs" AND uri_path="/wp-content/plugins/wp-import-export-lite/includes/classes/class-wpie-general.php" AND query_string="*wpie_download*"

📊 Metadata

CVE ID: CVE-2022-0236

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-862

Published: January 18, 2022

Last Updated: November 21, 2024

🔗 References

https://github.com/qurbat/CVE-2022-0236 Exploit,Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.php Patch,Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0236 Third Party Advisory
https://github.com/qurbat/CVE-2022-0236 Exploit,Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.php Patch,Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0236 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-0236, you might also want to check these: