CVE-2023-3459

Summary

CVE-2023-3459 is a vulnerability affecting the Export and Import Users and Customers plugin for WordPress. This issue allows authenticated attackers with shop manager-level permissions to unauthorizedly modify data, specifically user passwords, via an AJAX action within versions up to 2.4.1. Successful exploitation of this vulnerability could potentially result in takeover of administrator accounts. The 'hf_update_customer' function lacks proper capability checks, making it an easy target for attackers. WordPress users are advised to update the plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.