Skip to main content

Wp All Import CVE-2022-36386

HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2022-09-21 audit@patchstack.com
RCE WordPress File Upload Wp All Import
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 21, 2022 - 20:15 nvd
HIGH 7.2

DescriptionNVD

Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.

AnalysisAI

Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. Affected products include: Soflyy Wp All Import.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Wp All Import

View all
CVE-2022-1565 HIGH POC
7.2 Jul 18

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_impo
CVE-2022-3418 HIGH POC
7.2 Nov 07

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allo
CVE-2022-2711 HIGH POC
7.2 Nov 07

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in upload
CVE-2022-2268 HIGH POC
7.2 Jul 04

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip
CVE-2021-24714 MEDIUM POC
4.8 Dec 06

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier
CVE-2024-9664 HIGH
7.2 Feb 07

The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4
CVE-2018-0547 MEDIUM
6.1 Mar 09

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.7 for WordPress allows an attacker to in
CVE-2018-0546 MEDIUM
6.1 Mar 09

Cross-site scripting vulnerability in WP All Import plugin prior to version 3.4.6 for WordPress allows an attacker to in
CVE-2024-32431 MEDIUM
4.4 Apr 15

Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.2. Rated medium severity (CVSS 4.

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2022-36386 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy