Описание
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.6.8 (исключая)
cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 76%
0.00956
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-434
CWE-434
Связанные уязвимости
CVSS3: 7.2
github
больше 3 лет назад
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
EPSS
Процентиль: 76%
0.00956
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-434
CWE-434