Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

wpallimport

Source -

CNANVD

BOS Name -

N/A

CNA CVEs -

1

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

2
Related CVEsRelated ProductsRelated AssignersReports
2Vulnerabilities found
CVE-2024-32431
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-4.4||MEDIUM
EPSS-0.31% / 53.33%
||
7 Day CHG~0.00%
Published-15 Apr, 2024 | 07:16
Updated-02 Apr, 2025 | 15:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection

Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.

Action-Not Available
Vendor-wpallimportWP All Import
Product-wp_all_importImport Users from CSV
CWE ID-CWE-502
Deserialization of Untrusted Data
CVE-2022-1565
Assigner-Wordfence
ShareView Details
Assigner-Wordfence
CVSS Score-7.2||HIGH
EPSS-49.05% / 97.69%
||
7 Day CHG~0.00%
Published-18 Jul, 2022 | 00:00
Updated-31 Jan, 2025 | 18:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.

Action-Not Available
Vendor-wpallimportwpallimport
Product-wp_all_importImport any XML or CSV File to WordPress
CWE ID-CWE-434
Unrestricted Upload of File with Dangerous Type