CVE-2020-36849 AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload

🗓️ 12 Jul 2025 11:23:40Reported by WordfenceType

AIT CSV import/export plugin for WordPress allows unauthenticated file uploads, risking remote code execution.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2020-36849	11 Jan 202121:43	–	circl
CNNVD	WordPress plugin AIT CSV import/export 代码问题漏洞	12 Jul 202500:00	–	cnnvd
CNVD	WordPress plugin AIT CSV import/export code issue vulnerability	18 Jul 202500:00	–	cnvd
CVE	CVE-2020-36849	12 Jul 202511:23	–	cve
EUVD	EUVD-2020-30798	7 Oct 202500:30	–	euvd
Metasploit	WordPress AIT CSV Import Export Unauthenticated Remote Code Execution	12 Jan 202117:42	–	metasploit
NVD	CVE-2020-36849	12 Jul 202512:15	–	nvd
Positive Technologies	PT-2025-29320 · WordPress · Ait Csv Import/Export	12 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2020-36849	14 Jul 202512:20	–	redhatcve
Vulnrichment	CVE-2020-36849 AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload	12 Jul 202511:23	–	vulnrichment

[
  {
    "vendor": "AIT Themes",
    "product": "AIT CSV import/export",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.0.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cece751c-400d-42b4-9438-950d5aca51fc
github	www.github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/wp_ait_csv_rce.rb
ait-themes	www.ait-themes.club/wordpress-plugins/csv-import-export/
acunetix	www.acunetix.com/vulnerabilities/web/wordpress-plugin-ait-themes-csv-import-export-arbitrary-file-upload-3-0-3/
wpscan	www.wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_ait_csv_rce.rb

08 Apr 2026 17:24Current

CVSS 3.19.8

EPSS0.85696

CWE-434