CVE-2022-36386 Code injection in Import any XML or CSV File to WordPress (WordPress plugin)
Authenticated attackers can execute arbitrary code via the Import any XML or CSV File to WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36386?
CVE-2022-36386 is a critical code injection vulnerability in Soflyy Import any XML or CSV File to WordPress (WordPress plugin), published on 21 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.
Which versions are affected by CVE-2022-36386?
It affects 1 product.
Products include Soflyy Wp All Import.
How do I fix CVE-2022-36386?
No fix has been published for CVE-2022-36386 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-36386 being exploited?
There is no known exploitation of CVE-2022-36386 in the wild and no public exploit code.
Other vulnerabilities in Soflyy Import any XML or CSV File to WordPress (WordPress plugin)
- CVE-2015-9330 SQL injection in n/a
- CVE-2015-9331 Missing authorization in n/a
- CVE-2024-9664 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File
- CVE-2022-2711 WP All Import < 3.6.9 - Admin+ Directory traversal via file upload
- CVE-2022-3418 WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE
Sources
Also known as GHSA-27v6-4m9p-3qq4.