CVE-2023-5882

8.8 highEPSS 0.5%

High (8.8) in soflyy. EPSS 0.5% chance of exploitation in the next 30 days.

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2023-12-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

soflyy:export_any_wordpress_data_to_xml\/csv
soflyy:wp_all_export

References

https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2
https://wpscan.com/vulnerability/72be4b5c-21be-46af-a3f4-08b4c190a7e2

Check your stack JSON