CVE-2022-3418

WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

Affected

Import any XML or CSV File to WordPress

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.22% chance of exploitation in the next 30 days, 68th percentile

Published

2022-11-07

Updated

2025-05-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d

References

• CVE Record
• NVD entry