CVE-2022-3418

CVE-2022-3418: WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

Vendor Unknown

Product Import any XML or CSV File to WordPress

Weakness CWE-94 · Code injection

Published November 7, 2022

Last update May 1, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

Key dates

02Disclosure timeline

November 7, 2022 CVE published

May 1, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3418 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html