CVE-2022-1565

🗓️ 18 Jul 2022 00:00:00Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 97 Views🌐 WEB

WP All Import plugin <=3.6.7 allows arbitrary file uploads, leading to potential remote code executio

Reporter	Title	Published	Views	Family All 15
0day.today	WordPress WP All Import v3.6.7 - Remote Code Execution Exploit	29 Mar 202300:00	–	zdt
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Wpallimport Wp_All_Import	21 Jun 202411:08	–	githubexploit
Circl	CVE-2022-1565	18 Jul 202220:39	–	circl
CNNVD	WordPress plugin WP All Import 代码问题漏洞	18 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-1565 Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload	18 Jul 202200:00	–	cvelist
Exploit DB	WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)	29 Mar 202300:00	–	exploitdb
NVD	CVE-2022-1565	18 Jul 202217:15	–	nvd
OpenVAS	WordPress Import any XML or CSV File to WordPress Plugin < 3.6.8 RCE Vulnerability	19 Jul 202200:00	–	openvas
OSV	CVE-2022-1565	18 Jul 202217:15	–	osv
Packet Storm	WordPress WP All Import 3.6.7 Remote Code Execution	30 Mar 202300:00	–	packetstorm

NVD

Vulners

Node

wpallimport wp_all_importRange<3.6.8wordpress

[
  {
    "vendor": "wpallimport",
    "product": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.6.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5d281333-d9af-4eb7-bc5c-ea7ceeddac03
wordfence	www.wordfence.com/vulnerability-advisories/
plugins	www.plugins.trac.wordpress.org/changeset/2749264/wp-all-import/trunk

Parameter	Position	Path	Description	CWE
payload_file_name	request body	/wp-content/plugins/wp-all-import/wp_all_import_get_gz.php	Arbitrary file upload via wp_all_import_get_gz.php in WP All Import <= 3.6.7 leading to potential RCE	CWE-434
zip_file_to_upload	request body	/wp-content/plugins/wp-all-import/wp_all_import_get_gz.php	Arbitrary file upload via wp_all_import_get_gz.php in WP All Import <= 3.6.7 leading to potential RCE	CWE-434
wpnonce_upload_file	request body	/wp-content/plugins/wp-all-import/wp_all_import_get_gz.php	Arbitrary file upload via wp_all_import_get_gz.php in WP All Import <= 3.6.7 leading to potential RCE	CWE-434

08 Apr 2026 18:17Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.2

EPSS0.51833

SSVC

CWE-434