Description
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://patchstack.com/database/vulnerability/wp-all-import/wordpress-import-any-xml-or-csv-file-to-wordpress-plugin-3-6-7-authenticated-arbitrary-code-execution-vulnerability
Product, Release Notes x_refsource_confirm
https://wordpress.org/plugins/wp-all-import/#developers
Scores
CVSS v3
9.1
EPSS
0.0552
EPSS Percentile
90.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-434
CWE-94
Status
published
Products (2)
Soflyy/Import any XML or CSV File to WordPress (WordPress plugin)
<= 3.6.7 - 3.6.7
soflyy/wp_all_import
< 3.6.7
Published
Sep 21, 2022
Tracked Since
Feb 18, 2026