PT-2022-14958 · WordPress · Import Csv Files

Benachi · Published 2022-07-17 · Updated 2023-07-04 · CVE-2022-2146

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Import CSV Files WordPress plugin version 1.0

Description The issue is related to the Import CSV Files WordPress plugin, which does not properly sanitise and escape imported data before outputting it back on a page. Additionally, it lacks a CSRF check when performing such actions, resulting in a Reflected Cross-Site Scripting issue.

Recommendations For version 1.0, consider disabling the import functionality until a patch is available to prevent potential exploitation. Restrict access to the plugin's functionality to minimize the risk of Reflected Cross-Site Scripting attacks. Avoid using the plugin for importing CSV files until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-2146

Affected Products

Import Csv Files

References · 5

• 🔥 https://wpscan.com/vulnerability/adc1d752-331e-44af-b5dc-b463d56c2cb4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2146 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2146 · Vendor Advisory
• https://t.me/cvenotify/33281 · Telegram Post
• https://t.me/cibsecurity/46389 · Telegram Post