blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1273

HIGH 7.2 CVSS 3.1
Published
May 2, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE

Affected WordPress components

  • Import WP – CSV & XML Import Export for WordPress Plugin · jc-importer
    Confirmed match Active
    From 2.4.6 (including) to 2.4.6 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Import WP – Import and Export WordPress data to XML or CSV files — From 2.4.6 (including) to 2.4.6 (excluding)
  • importwp import_wp — Before 2.4.6

References

  • wpscan.com https://wpscan.com/vulnerability/ad99b9ba-5f24-4682-a787-00f0e8e32603 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record