CVE-2022-3244 - Import all XML, CSV & TXT into WordPress < 6.5.8

Back Back to CVE browser

MEDIUM

Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation

Published Oct 17, 2022

4.2

MEDIUM

CVSS 3.1

EPSS 0.42%

Description

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce

Affected products

Vendor n/a Product Import all XML, CSV & TXT into WordPress Default
n/a
- Version
  6.5.8
  Status
  affected
  Constraints
  <6.5.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Import all XML, CSV & TXT into WordPress

n/a

Version	Status	Constraints
6.5.8	affected	<6.5.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42651
Advisory
https://wpscan.com/vulnerability/de4bc449-3dd4-4776-943f-ac59ae813132
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42651		Advisory
https://wpscan.com/vulnerability/de4bc449-3dd4-4776-943f-ac59ae813132		ExploitThird Party Advisory