CVE-2022-1565
HIGHWP All Import < 3.6.8 - Authenticated Arbitrary File Upload via wp_all_import_get_gz.php
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-1565. PoCs published by AkuCyberSec, phanthibichtram12.
AI-analyzed exploit summary This exploit leverages an arbitrary file upload vulnerability in WP All Import (CVE-2022-1565) to achieve RCE. It requires admin credentials to upload a malicious ZIP file containing a PHP payload, bypassing file type validation.
Description
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Exploits (2)
This exploit leverages an arbitrary file upload vulnerability in WP All Import (CVE-2022-1565) to achieve RCE. It requires admin credentials to upload a malicious ZIP file containing a PHP payload, bypassing file type validation.
This repository contains a Python-based exploit for CVE-2022-1565, targeting an arbitrary file upload vulnerability in the WordPress WP All Import plugin (versions <= 3.6.7). The exploit allows authenticated attackers with admin privileges to upload malicious files, potentially leading to remote code execution (RCE).
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H