CVE-2024-6477

PoC —

CVSS 3.1

7.5 high

EPSS

<1%p46

Published

Aug 3, 2024 (Aug 3, 2024)

Modified

Jun 17, 2026

Description

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address

Vendors: ayecode
Products: userswp
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.