Import CSV or XML Datafeed With Ease, adf319f8d6673b9cfcd537ded704e0028f0a0419

CVE, Research URL: adf319f8d6673b9cfcd537ded704e0028f0a0419
Home page URL: Security reports for Import CSV or XML Datafeed With Ease
Application: Import CSV or XML Datafeed With Ease
Published on: Jan 12, 2022
Research Description: WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel [wp-ultimate-csv-importer] < 6.4.1 Easy Drag And drop All Import : WP Ultimate CSV Importer < 6.4.1 - Missing Authorization Checks The WP Ultimate CSV Importer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions like upload_function(), display_log(), download_log(), display_csv_values(), etc... in versions up to 6.4.1. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to perform many unauthorized actions and retrieve sensitive data.
Affected versions: max 6.4.1.
Status: vulnerable