CVE-2022-1273

CVE-2022-1273: Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE

Vendor Unknown

Product Import WP – Import and Export WordPress data to XML or CSV files

Weakness CWE-434 · Unrestricted file upload

Published May 2, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE

Key dates

02Disclosure timeline

May 2, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1273 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-7847 AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2024-9280 kalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted upload CVE-2025-54441 CVE-2024-1261 Juanpao JPShop API ComboController.php actionIndex unrestricted upload CVE-2025-62047 WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability