CVE-2024-22151
📋 TL;DR
This CVE describes a Missing Authorization vulnerability in the WordPress 'Import and export users and customers' plugin. It allows unauthorized users to access functionality intended only for administrators, potentially enabling user data export or import operations. All WordPress sites using affected plugin versions are vulnerable.
💻 Affected Systems
- WordPress Import and export users and customers plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attackers could export all user data including sensitive information, or import malicious users with administrative privileges, leading to complete site compromise.
Likely Case
Attackers with basic user accounts could access administrative import/export functions, potentially exposing user data or manipulating user accounts.
If Mitigated
With proper access controls, only authenticated administrators could access these functions, limiting exposure to trusted personnel.
🎯 Exploit Status
Exploitation requires at least some level of user access, but detailed exploit methods are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.24.7 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Import and export users and customers'. 4. Click 'Update Now' if available, or download version 1.24.7+ from WordPress repository. 5. Replace plugin files if manual update required.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate import-users-from-csv-with-meta
Restrict Access via .htaccess
linuxBlock access to plugin directories for non-administrative users
# Add to .htaccess in plugin directory:
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the WordPress admin interface
- Enable detailed logging and monitoring for any import/export user activities
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins, find 'Import and export users and customers' and check version numberCheck Version:
wp plugin get import-users-from-csv-with-meta --field=versionVerify Fix Applied:
Verify plugin version is 1.24.7 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /wp-admin/admin.php?page=acui* endpoints
- Unexpected user export or import operations from non-admin accounts
Network Indicators:
- HTTP requests to import/export endpoints from unauthorized IP addresses
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin.php" AND uri_query="page=acui*") AND user_role!="administrator"🔗 References
- https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-24-6-broken-access-control-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-24-6-broken-access-control-vulnerability?_s_id=cve
