Skip to content
Sign in
7.5 High

CVE-2024-6477 The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could…

Description

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

Affected products and versions

Product Affected versions Fixed in
UsersWP 1.2 earliest → < 1.2.12 1.2.12
userswp 1.2 earliest → < 1.2.12 1.2.12

Other CVEs of UsersWP

The 3 CVEs of UsersWP →
CVE-2026-86814 The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an… 8.1 High CVE-2026-13690 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor… 7.4 High
Track this CVE