CVE-2022-2268 WP All Import < 3.6.8 - Admin+ Arbitrary File Upload

2022-07-0413:06:04

CWE-434

WPScan

www.cve.org

wp all import

arbitrary file upload

wordpress

rce

EPSS

0.001

Percentile

42.9%

JSON

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

CNA Affected

[
  {
    "product": "Import any XML or CSV File to WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.6.8",
        "status": "affected",
        "version": "3.6.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7

EPSS

0.001

Percentile

42.9%

JSON

Related for CVELIST:CVE-2022-2268