CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
WP All Import versions up to 3.9.3 contain an unrestricted file upload vulnerability. An authenticated administrator can upload files without proper validation, potentially allowing them to upload malicious files to the server. This could lead to unauthorized access, data theft, or site compromise depending on file type and server configuration.
What an attacker can do
Upload files without proper validation to the server.
Potential impact on your site
An admin account compromise could allow file uploads leading to site takeover or data breach.
Conditions required to exploit
Attacker must have administrator-level access to WordPress.
Key dates
External resources
Related vulnerabilities
