Import CSV or XML Datafeed With Ease, 5c64c2c35f1ce619d7c608c8987d92af2239c980

CVE, Research URL: 5c64c2c35f1ce619d7c608c8987d92af2239c980
Home page URL: Security reports for Import CSV or XML Datafeed With Ease
Application: Import CSV or XML Datafeed With Ease
Published on: Apr 27, 2015
Research Description: WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel [wp-ultimate-csv-importer] < 3.7.1 WP Ultimate CSV Importer <= 3.7 - Arbitrary File Read The WP Ultimate CSV Importer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the templates/readfile.php file in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to read any files on the vulnerable service that PHP has access to.
Affected versions: max 3.7.1.
Status: vulnerable