CVE-2023-4521: Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 40.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-25 · updated 2026-06-17

Description

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue (https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42) and not deleting the created files when releasing the new version.

Affected products

Import XML and RSS Feeds: before 2.1.5 — fixed in 2.1.5

How to fix

Upgrade to a fixed version: Import XML and RSS Feeds 2.1.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481
https://wpscan.com/vulnerability/de2cdb38-3a9f-448e-b564-a798d1e93481

Get alerted when CVE-2023-4521 or the next vulnerability affects your stack