CVEvulnerability

CVE-2022-2711

7.2 HIGH Published 2022-11-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22

Description

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.

Affected configurations

• soflyy wp all import (< 3.6.9)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References