High severity7.2NVD Advisory· Published Nov 7, 2022· Updated Jun 17, 2026

CVE-2022-3418

Description

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Wp Ultimate CSV Importerinferred
Range: <3.6.9
Package: https://wordpress.org/plugins/wp-ultimate-csv-importer
Soflyy/Wp All Import
cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:*:wordpress:*:*
Range: <3.6.9
WordPress/Import Any XML Or CSV File To Wordpressllm-fuzzy
Range: <3.6.9
Package: https://wordpress.org/plugins/import-any-xml-or-csv-file-to-wordpress

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94dnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000