CVE-2023-2447

CVE-2023-2447 describes a Cross-Site Request Forgery (CSRF) vulnerability in the UserPro plugin for WordPress, affecting versions up to and including 5.1.1. This flaw stems from inadequate nonce validation in the 'export_users' function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to the unauthorized export of user data to a CSV file. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. While user data can be exposed, there is no impact on availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, or entries in ExploitDB. The vulnerability has also received minimal community discussion and media coverage, suggesting low awareness and limited immediate threat.