CVE-2022-3243 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi

2022-10-1700:00:00

CWE-89

WPScan

www.cve.org

cve-2022-3243

wordpress

sql injection

xml

csv

txt

admin

EPSS

0.001

Percentile

32.2%

JSON

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Import all XML, CSV & TXT into WordPress",
    "versions": [
      {
        "version": "6.5.8",
        "status": "affected",
        "lessThan": "6.5.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a

EPSS

0.001

Percentile

32.2%

JSON

Related for CVELIST:CVE-2022-3243