Vulnerabilities and security researches forjc-importer jc-importer

Jun 06, 2024

CVE, Research URL: CVE-2023-7253
Home page URL: Security reports for Import WP – Export and Import CSV and XML files to WordPress
Application: Import WP – Export and Import CSV and XML files to WordPress
Date: Apr 24, 2024
Research Description: The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
Affected versions: max 2.13.1.
Status: vulnerable

CVE, Research URL: CVE-2022-1273
Home page URL: Security reports for Import WP – Export and Import CSV and XML files to WordPress
Application: Import WP – Export and Import CSV and XML files to WordPress
Date: May 02, 2022
Research Description: The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
Affected versions: max 2.4.6.
Status: vulnerable

Jan 27, 2025

CVE, Research URL: CVE-2024-13562
Home page URL: Security reports for Import WP – Export and Import CSV and XML files to WordPress
Application: Import WP – Export and Import CSV and XML files to WordPress
Date: Jan 25, 2025
Research Description: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/ directory which can contain information like imported or local user data and files.
Affected versions: max 2.14.6.
Status: vulnerable

Nov 12, 2025

CVE, Research URL: CVE-2025-12137
Home page URL: Security reports for Import WP – Export and Import CSV and XML files to WordPress
Application: Import WP – Export and Import CSV and XML files to WordPress
Date: Nov 01, 2025
Research Description: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when handling 'file_local' actions. This makes it possible for authenticated attackers, with administrator-level access and above, to read arbitrary files on the server's filesystem, including sensitive configuration files and system files via the 'local_url' parameter.
Affected versions: max 2.14.17.
Status: vulnerable