CVE-2022-2268

high

Description

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE

References

https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7

Details

Source: Mitre, NVD

Published: 2022-07-04

Updated: 2022-11-05

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

Detections

Analytics