ThreatPress

WordPress Vulnerabilities Database

Back

WordPress WP All Import Plugin <= 3.2.3 - Remote Code Execution

Product
Import any XML or CSV File to WordPress
Description
Because of this vulnerability, remote attackers can upload arbitrary files to system or retrieve any files on the system that ends in .txt or .html.
Solution
Update the plugin.
Classification
Type Arbitrary Code Execution
OWASP Top 10 A1: Injection
References
Pritect
Packet Storm Security
CVE
Name CVE-N/A
Versions
Affected In <= 3.2.3
Fixed In 3.2.4
Disclosure date
2015-02-26
Credits
Evex
Submitter
ThreatPress