PT-2023-27941 · WordPress · Wp Ultimate Csv Importer

István Márton + 1 · Publicado 2023-08-04 · Atualizado 2023-08-08 · CVE-2023-4141

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer plugin for WordPress versions up to, and including, 7.9.8

Description The issue allows authenticated attackers with author-level permissions or above to execute code on the server via the ->cus2 parameter, enabling them to create a PHP file. This is possible if the administrator previously grants access in the plugin settings.

Recommendations For WP Ultimate CSV Importer plugin for WordPress versions up to, and including, 7.9.8, the author resolved this issue by removing the ability for authors and editors to import files. However, site administrators can still create PHP files, so use the plugin with caution.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-4141

Produtos afetados

Wp Ultimate Csv Importer

Referências · 5

• https://plugins.trac.wordpress.org/changeset/2944635/wp-ultimate-csv-importer/trunk/wp-ultimate-csv-importer.php · Correção
• https://osv.dev/vulnerability/CVE-2023-4141 · Aviso do Fabricante
• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.9.6/importExtensions/ImportHelpers.php#L205 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-4141 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/b4fe8b1f-da1c-4f94-9ab4-272766b488c3?source=cve · Nota