CVE-2023-7082

WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE

High · published January 22, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01231 · 68.7th percentile
Published
2024-01-22T19:14Z
EPSS history
Timeline
  • 22 JAN 19:14Z
    WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCE
    cvelistv5