CVE-2022-3677

Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF

Medium · published December 5, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.2th percentile
Published
2022-12-05T16:50Z
EPSS history
Timeline
  • 05 DEC 16:50Z
    Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF
    cvelistv5