CVE-2022-1273CWE-434

Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE

published May 2, 2022

CVSS
—
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01472 · 73.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-05-02T16:05Z
EPSS history
Timeline
  • 02 MAY 16:05Z
    Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
    cvelistv5