Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated attackers to extract sensitive user data, for instance, email addresses, hashed passwords, and IP addresses.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| katsushi-kawamori | Moving Users | up to 1.05 | — | No fix listed | CNA |
- Moving Users Vendorkatsushi-kawamori Affected up to 1.05 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-12637
- 2026-10-03 Alias added: GHSA-5vw8-cc54-v3pg
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8209761c-2cfe-49b9-ab4c-49a9a13b5dcf?source=cve
- https://wordpress.org/plugins/moving-users/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223894%40moving-users&new=3223894%40moving-users&sfp_email=&sfph_mail=
More katsushi-kawamori vulnerabilities
- TI-2026-01794 Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage CVSS 3.1HIGH 8.1
- TI-2024-12917 Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion CVSS 3.1MEDIUM 6.5
- TI-2026-24885 WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability CVSS 3.1MEDIUM 6.4
Sources
- CVE-2024-12637 · CVE Program
- CVE-2024-12637 · NVD
- FIRST EPSS
- GHSA-5vw8-cc54-v3pg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences