CVE-2023-4300 Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload

2023-09-2515:56:51

WPScan

www.cve.org

wordpress plugin

file upload

remote code execution

0.001 Low

EPSS

Percentile

43.5%

JSON

The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Import XML and RSS Feeds",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.1.4"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42

0.001 Low

EPSS

Percentile

43.5%

JSON

Related for CVELIST:CVE-2023-4300