CVE-2024-31292 HIGH

CVE-2024-31292: WordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerability

Vendor Moove Agency
Product Import XML and RSS Feeds
Weakness CWE-434 · Unrestricted file upload
Published April 7, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a through 2.1.5.

Explanation of Vulnerability in Simple Terms

02Summary

The Import XML and RSS Feeds plugin for WordPress contains an unrestricted file upload vulnerability in versions up to 2.1.5. An authenticated administrator can upload arbitrary files to the site, potentially including PHP scripts or other executable code. This allows an attacker with admin access to gain full control of the site's file system and execute malicious code.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files, including executable code, to the site's server.

Potential impact on your site

04Site Impact

A compromised admin account can be used to upload malware, backdoors, or web shells, leading to full site compromise.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

April 7, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-13430 Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import CVE-2018-25436 WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload CVE-2026-14894 Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) CVE-2026-14270 Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings CVE-2026-2354 Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()