CVE-2023-4141

2023-08-0403:15:14

[email protected]

web.nvd.nist.gov

wp ultimate csv importer

wordpress

remote code execution

cve-2023-4141

vulnerability

security advisory

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.0%

JSON

The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the ‘->cus2’ parameter. This allows authenticated attackers with author-level permissions or above, if the administrator previously grants access in the plugin settings, to create a PHP file and execute code on the server. The author resolved this vulnerability by removing the ability for authors and editors to import files, please note that this means php file creation is still allowed for site administrators, use the plugin with caution.

Affected configurations

Vulners

NVD

Node

smackcodersimport_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csvRange≤7.9.8

VendorProductVersionCPE
smackcodersimport_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv*cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
smackcoders	import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv	*	cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv::::::::

CNA Affected

[
  {
    "vendor": "smackcoders",
    "product": "Import All Pages, Post types, Products, Orders, and Users as XML & CSV",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "7.9.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]