PT-2022-18227 · WordPress · Import Any Xml/Csv File To Wordpress

Lucy · Published 2022-11-07 · Updated 2025-05-05 · CVE-2022-2711

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Import any XML or CSV File to WordPress plugin versions prior to 3.6.9

Description The issue allows highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector. This is due to the plugin not validating the paths of files contained in uploaded zip archives.

Recommendations For versions prior to 3.6.9, update to version 3.6.9 or later to resolve the issue. As a temporary workaround, consider restricting the upload of zip archives or limiting the privileges of users who can upload files to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-2711

Affected Products

Import Any Xml/Csv File To Wordpress

References · 5

• 🔥 https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-2711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2711 · Security Note
• https://t.me/cvenotify/37407 · Telegram Post
• https://t.me/cvenotify/120887 · Telegram Post