Import CSV or XML Datafeed With Ease, 79f7431831f08b32ac167aa67b14bf1b6065413f

CVE, Research URL: 79f7431831f08b32ac167aa67b14bf1b6065413f
Home page URL: Security reports for Import CSV or XML Datafeed With Ease
Application: Import CSV or XML Datafeed With Ease
Published on: Jan 12, 2022
Research Description: WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel [wp-ultimate-csv-importer] < 6.4.1 WP Ultimate CSV Importer <= 6.4.0 - Arbitrary File Upload The WP Ultimate CSV Importer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip_upload AJAX call in versions up to, and including, 6.4.0. This makes it possible for subscriber-level attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Affected versions: max 6.4.1.
Status: vulnerable