Import CSV or XML Datafeed With Ease, 64bd22e2-ea38-4b6f-be54-e81f9e77bdc2

CVE, Research URL: 64bd22e2-ea38-4b6f-be54-e81f9e77bdc2
Home page URL: Security reports for Import CSV or XML Datafeed With Ease
Application: Import CSV or XML Datafeed With Ease
Published on: -
Research Description: WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import [wp-ultimate-csv-importer] < 6.4.1 WP Ultimate CSV Importer < 6.4.1 - Subscriber+ Arbitrary File Upload The plugin does not have authorisation and CSRF checks when uploading zip files via the zip_upload AJAX call, and does not perform any check on the files to be extracted. As a result, any authenticated user, such as subscriber could upload an archive with PHP files in it, leading to RCE
Affected versions: max 6.4.1.
Status: vulnerable