Description

Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T15:17:21.723Z",
  "pubdate": "2026-08-06T15:17:21.723Z",
  "executiveSummary": "An unauthenticated sensitive data exposure vulnerability exists within the Export Import Menus plugin for versions <= 1.9.2. This security flaw allows remote, unauthenticated threat actors to harvest critical configuration data or sensitive application artifacts without requiring valid user credentials or session tokens.\nThe vulnerability directly impacts the confidentiality of the target web application by exposing export and import functionality to the public network perimeter. The absence of proper access control checks on sensitive endpoints enables unauthorized users to trigger data extraction routines remotely.\nRisk implications include the potential leakage of proprietary site configurations, database structures, or internal application metadata, which can facilitate subsequent attack vectors such as privilege escalation, further reconnaissance, or targeted exploitation.\nExploitation requirements are minimal, requiring only network connectivity to the target application and knowledge of the vulnerable component's endpoint paths. Attackers do not need prior system access, elevated privileges, or interaction with legitimate users to successfully extract the exposed data.",
  "technicalDetails": "The vulnerability resides in the Export Import Menus plugin for versions <= 1.9.2, specifically within the functional components responsible for handling data export and import routines. The root cause of the flaw is a complete lack of authorization checks and access control validation on sensitive administrative or utility endpoints.\nNetwork exposure is direct, as the affected functionalities are accessible over standard HTTP/HTTPS protocols without enforcing authentication mechanisms or session validations. Consequently, any remote attacker can interact directly with the vulnerable components by issuing crafted HTTP requests to the exposed endpoints.\nThe step-by-step attack flow initiates with the attacker performing reconnaissance to identify the presence of the Export Import Menus plugin and its associated handler scripts or REST API routes. Upon locating the unauthenticated endpoint, the attacker issues a direct GET or POST request to invoke the data export functionality.\nUpon receiving the request, the vulnerable component fails to verify whether the requester possesses administrative privileges or holds an authenticated session. Instead, the backend function executes the data serialization and generation routine without restriction.\nThe payload behavior involves the application gathering internal configuration states, menu definitions, or other sensitive metadata and packaging them into a downloadable format, such as an XML, JSON, or CSV file. This generated payload is then returned directly in the HTTP response body to the unauthenticated requester.\nPost-exploitation impact centers on unauthorized information disclosure. The acquired data may contain sensitive application parameters, internal routing details, user metadata, or structural configurations that significantly reduce the effort required for an attacker to mount more sophisticated compromises against the underlying system."
}