TI-2022-02509 Aliases CVE-2022-2711 GHSA-fwj8-64xx-fwh9

WP All Import < 3.6.9 - Admin+ Directory traversal via file upload

HIGH 65CWE-22Published 2022-11-07 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.04265 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Import any XML or CSV File to WordPress (Unknown): 3.6.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Import any XML or CSV File to WordPress	3.6.9 to before 3.6.9	3.6.9	Patch available	CNA

Import any XML or CSV File to WordPress VendorUnknown Affected 3.6.9 to before 3.6.9 Fixed in 3.6.9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:soflyy:wp_all_import::::::wordpress::*	before 3.6.9	Vulnerable	Soflyy

cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:*:wordpress:*:* Versions before 3.6.9 Vulnerable ·Soflyy

Remediation

Fix · CNA Import any XML or CSV File to WordPress (Unknown) Fixed in 3.6.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-11-07
Import any XML or CSV File to WordPress 3.6.9
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2022-03156 WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCEPriority HIGH 67
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-2711
2026-10-03 Alias added: GHSA-fwj8-64xx-fwh9
2026-11-04 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://wpscan.com/vulnerability/11e73c23-ff5f-42e5-a4b0-0971652dcea1

TI-2022-03156 WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE CVSS 3.1HIGH 7.2
TI-2015-07707 The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. CVSS 3.0CRITICAL 9.8
TI-2022-16725 WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability CVSS 3.1CRITICAL 9.1
TI-2015-07708 The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. CVSS 3.0HIGH 7.5
TI-2024-08966 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File CVSS 3.1HIGH 7.2
TI-2022-02093 WP All Import < 3.6.8 - Admin+ Arbitrary File Upload CVSS 3.1HIGH 7.2

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences