The Import any XML or CSV File to WordPress plugin prior to 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
soflyy export any wordpress data to xml\\/csv |
Vulmon