Medium severity · published Oct 11, 2024
CVE-2024-7514
WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The issue was partially fixed in version 2.3.8 and fully fixed in 2.3.9
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Comments Import & Export · webtoffee
through 2.3.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7514
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/tags/2.3.7/includes/importer/class-hf_cmt_impexpcsv-import.php#L346
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/30a79974-ee61-4764-8864-89659b1848a4?source=cve
More from Comments Import & Export
7.7
CVE-2026-32441
WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability
6.4
CVE-2025-3919
WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting