CVE-2022-3243CWE-89

Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi

High · published October 17, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
70.2
In the wild
Unconfirmed
What it is

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01297 · 70.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-10-17T00:00Z
EPSS history
Timeline
  • 17 OCT 00:00Z
    Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
    cvelistv5