CVE-2022-2268CWE-434

WP All Import < 3.6.8 - Admin+ Arbitrary File Upload

published July 4, 2022

CVSS
—
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01420 · 72.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-07-04T13:06Z
EPSS history
Timeline
  • 04 JUL 13:06Z
    WP All Import < 3.6.8 - Admin+ Arbitrary File Upload
    cvelistv5