Unrated severityNVD Advisory· Published Nov 7, 2022· Updated May 1, 2025

WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

CVE-2022-3418

Description

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Wp Ultimate CSV Importerinferred
Range: <3.6.9
Package: https://wordpress.org/plugins/wp-ultimate-csv-importer
WordPress/Import Any XML Or CSV File To Wordpressllm-create
Range: <3.6.9
Package: https://wordpress.org/plugins/import-any-xml-or-csv-file-to-wordpress

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94dmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000