CVE-2022-3418: WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-07 · updated 2026-06-17
Weakness: CWE-94

Description

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

Affected products

Import any XML or CSV File to WordPress: before 3.6.9 — fixed in 3.6.9

How to fix

Upgrade to a fixed version: Import any XML or CSV File to WordPress 3.6.9. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d
https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d

Get alerted when CVE-2022-3418 or the next vulnerability affects your stack