CVE-2022-3418 WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE
Administrators in multi-site WordPress installations can upload arbitrary files to achieve remote code execution due to insufficient file extension filtering.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3418?
CVE-2022-3418 is a high-severity vulnerability in Unknown Import any XML or CSV File to WordPress, published on 7 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
Weakness: CWE-94
Which versions are affected by CVE-2022-3418?
It affects 1 product.
Products include Soflyy Wp All Import.
How do I fix CVE-2022-3418?
No fix has been published for CVE-2022-3418 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3418 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3418 exists.
Other vulnerabilities in Unknown Import any XML or CSV File to WordPress
- CVE-2015-9330 SQL injection in n/a
- CVE-2022-36386 Code injection in Import any XML or CSV File to WordPress (WordPress plugin)
- CVE-2015-9331 Missing authorization in n/a
- CVE-2024-9664 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File
- CVE-2022-2711 WP All Import < 3.6.9 - Admin+ Directory traversal via file upload
Sources
Also known as GHSA-qff8-jrqx-8xjm.