Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-1273

Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Import WP – Import and Export WordPress data to XML or CSV files

  • 2.4.6 to < 2.4.6affected

References