CVE-2022-2711

🗓️ 07 Nov 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 58 Views🌐 WEB

The WordPress plugin before 3.6.9 allows arbitrary file write

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-2711	5 May 202521:20	–	circl
CNNVD	WordPress plugin Import any XML or CSV File to WordPress 路径遍历漏洞	7 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-2711 WP All Import < 3.6.9 - Admin+ Directory traversal via file upload	7 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-34956	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2711	7 Nov 202210:15	–	nvd
OpenVAS	WordPress Import any XML or CSV File to WordPress Plugin < 3.6.9 Multiple File Upload Vulnerabilities	8 Nov 202200:00	–	openvas
OSV	CVE-2022-2711	7 Nov 202210:15	–	osv
Prion	Path traversal	7 Nov 202210:15	–	prion
Positive Technologies	PT-2022-18227 · WordPress · Import Any Xml/Csv File To Wordpress	7 Nov 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2711	23 May 202501:00	–	redhatcve

NVD

Vulners

Node

soflyy wp_all_importRange<3.6.9wordpress

[
  {
    "vendor": "Unknown",
    "product": "Import any XML or CSV File to WordPress",
    "versions": [
      {
        "version": "3.6.9",
        "status": "affected",
        "lessThan": "3.6.9",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1

Parameter	Position	Path	Description	CWE
name	request body	wp-admin/admin.php?page=pmxi-admin-settings&action=upload&_wpnonce=afb6fb6e5c	Zip slip: uploaded zip can include paths traversing to arbitrary filesystem locations, enabling arbitrary file write.	CWE-22
chunk	request body	wp-admin/admin.php?page=pmxi-admin-settings&action=upload&_wpnonce=afb6fb6e5c	Zip slip: uploaded zip can include paths traversing to arbitrary filesystem locations, enabling arbitrary file write.	CWE-22
chunks	request body	wp-admin/admin.php?page=pmxi-admin-settings&action=upload&_wpnonce=afb6fb6e5c	Zip slip: uploaded zip can include paths traversing to arbitrary filesystem locations, enabling arbitrary file write.	CWE-22
async-upload	request body	wp-admin/admin.php?page=pmxi-admin-settings&action=upload&_wpnonce=afb6fb6e5c	Zip slip: uploaded zip can include paths traversing to arbitrary filesystem locations, enabling arbitrary file write.	CWE-22

17 Jun 2026 04:42Current

7High risk

Vulners AI Score7

CVSS 3.17.2

EPSS0.03187

SSVC

CWE-22