Sensitive Information Exposure in Import and Export Users and Customers Plugin

Executive Summary

This vulnerability exists in the Import and export users and customers plugin for WordPress, affecting all versions up to and including 2.4.0. It allows authenticated users with subscriber-level access or higher to extract sensitive information by enumerating post IDs. Specifically, attackers can access the post_title and raw post_content of any post regardless of its status (such as draft, private, future, trash, or password-protected) or post type, including non-public custom post types like WooCommerce orders and internal CRM records.

The vulnerability is enabled because a security nonce required for protection is exposed as inline JavaScript on any wp-admin page when the URL parameter ?post_type=acui_email_template is appended. Since this page is accessible to any authenticated user, including subscribers, it allows them to bypass normal access controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Import and export users and customers plugin for WordPress is installed and running a version up to and including 2.4.0.

Since the vulnerability involves exposure of the codection-security nonce via inline JavaScript on any wp-admin page when the URL parameter ?post_type=acui_email_template is appended, you can test for this by accessing such URLs with an authenticated user account.

Commands or steps to detect the vulnerability might include:

• Log in to WordPress with a subscriber-level or higher account.
• Navigate to a wp-admin page and append ?post_type=acui_email_template to the URL.
• Inspect the page source or use developer tools to check for the presence of the codection-security nonce exposed in inline JavaScript.
• Attempt to enumerate post IDs via crafted requests to see if post_title and raw post_content of arbitrary posts (including drafts, private, future, trash, password-protected, and non-public CPTs) can be extracted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to sensitive information exposure. Attackers with low-level authenticated access can retrieve confidential data from posts that are normally restricted, including private or password-protected content and sensitive business data such as WooCommerce orders and CRM records.

Such unauthorized data access can compromise privacy, lead to data leaks, and potentially harm business operations or customer trust.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users with subscriber-level access to extract sensitive information from arbitrary posts, including private and protected content such as WooCommerce orders and internal CRM records.

Such unauthorized exposure of sensitive data could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

However, the provided context does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Update the Import and export users and customers plugin to a version later than 2.4.0 where the vulnerability is fixed.
• Restrict access to wp-admin pages and ensure that only trusted authenticated users have subscriber-level or higher access.
• Monitor and audit user accounts with subscriber-level access to detect any suspicious activity.
• If immediate update is not possible, consider disabling or removing the vulnerable plugin temporarily.

Useful 0 Not Useful 0