high7.2Public exploit code
CVE-2022-1565
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)2023-03-29 · webapps · php · Verified
Impact
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wpallimport | Wp All Import | before 3.6.8 |
Weakness classification
References
- NVD record
- CVE.org record
- https://plugins.trac.wordpress.org/changeset/2749264/wp-all-import/trunk?contextall=1&old=2737093&old_path=%2Fwp-all-import%2Ftrunk
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d281333-d9af-4eb7-bc5c-ea7ceeddac03?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1565
- https://plugins.trac.wordpress.org/changeset/2749264/wp-all-import/trunk?contextall=1&old=2737093&old_path=%2Fwp-all-import%2Ftrunk
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d281333-d9af-4eb7-bc5c-ea7ceeddac03?source=cve
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1565