CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
CSV Me versions 2.0 and earlier contain an unrestricted file upload vulnerability. An authenticated administrator can upload files without proper validation, potentially allowing them to upload malicious files to the server. This could lead to unauthorized access, data modification, or service disruption depending on where uploaded files are stored and executed.
What an attacker can do
Upload files without validation to the server.
Potential impact on your site
An admin account compromise could allow file uploads leading to data breach or site takeover.
Conditions required to exploit
Attacker must have administrator privileges on the site.
Key dates
External resources
