PT-2022-22047 · WordPress · Import Any Xml/Csv File To Wordpress

Lucy · Published 2022-11-07 · Updated 2022-11-09 · CVE-2022-3418

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Import any XML or CSV File to WordPress plugin versions prior to 3.6.9

Description The issue arises from the plugin not properly filtering allowed file extensions for import on the server. This could allow administrators in multi-site WordPress installations to upload arbitrary files.

Recommendations For versions prior to 3.6.9, update to version 3.6.9 or later to resolve the issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-3418

Affected Products

Import Any Xml/Csv File To Wordpress

References · 4

• 🔥 https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3418 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3418 · Vendor Advisory
• https://t.me/cvenotify/37409 · Telegram Post