CVE-2022-1800: Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-13 · updated 2026-06-17
Weakness: CWE-89

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.

Affected products

Soflyy Export Any Wordpress Data To Xml/Csv: before 1.3.5 — fixed in 1.3.5

How to fix

Upgrade to a fixed version: Soflyy Export Any Wordpress Data To Xml/Csv 1.3.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128
https://wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128

Get alerted when CVE-2022-1800 or the next vulnerability affects your stack