Import any XML or CSV File to WordPress, CVE-2022-2711

CVE, Research URL: CVE-2022-2711
Home page URL: Security reports for Import any XML or CSV File to WordPress
Application: Import any XML or CSV File to WordPress
Published on: Nov 07, 2022
Research Description: The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
Affected versions: Min -, max 3.6.5.
Status: vulnerable