Lucene search
WPScanCVELIST:CVE-2023-7082HistoryJan 22, 2024 - 7:14 p.m.
CVE-2023-7082 WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
2024-01-2219:14:29
WPScan
www.cve.org
2
cve-2023-7082
wordpress plugin
arbitrary file upload
rce
privilege escalation
EPSS
0.001
Percentile
43.4%
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Import any XML or CSV File to WordPress",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThan": "3.7.3"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
cve
cve
CVE-2023-7082
2024-01-22 20:15:47
nvd
nvd
CVE-2023-7082
2024-01-22 20:15:47
wpvulndb
wpvulndb
WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
2023-12-29 00:00:00
prion
prion
Remote code execution
2024-01-22 20:15:00
wpexploit
wpexploit
WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
2023-12-29 00:00:00