TI-2022-02996 Aliases CVE-2022-3243 GHSA-5cp7-rvwq-5jc9

Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi

HIGH 73CWE-89Published 2022-10-17 · Updated 2025-05-14

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01328 71st percentileScored 2026-11-08

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Import all XML, CSV & TXT into WordPress (Unknown): 6.5.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Import all XML, CSV & TXT into WordPress	6.5.8 to before 6.5.8	6.5.8	Patch available	CNA

Import all XML, CSV & TXT into WordPress VendorUnknown Affected 6.5.8 to before 6.5.8 Fixed in 6.5.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:::::wordpress:::*	before 6.5.8	Vulnerable	smackcoders

cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:wordpress:*:*:* Versions before 6.5.8 Vulnerable ·smackcoders

Remediation

Fix · CNA Import all XML, CSV & TXT into WordPress (Unknown) Fixed in 6.5.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-10-17
Import all XML, CSV & TXT into WordPress 6.5.8
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2022-02997 Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing AuthorisationPriority MEDIUM 53
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-3243
2026-10-03 Alias added: GHSA-5cp7-rvwq-5jc9

References

Exploit 1

https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a

TI-2022-02997 Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation CVSS 3.1MEDIUM 4.2
TI-2018-14929 The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. CVSS 3.0HIGH 8.8
TI-2015-08053 WP Ultimate CSV Importer Plugin cross-site request forgery CVSS 3.1HIGH 8.8
TI-2022-01833 WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF CVSS 3.1HIGH 7.2
TI-2015-07683 The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. CVSS 3.0MEDIUM 6.1
TI-2022-00285 WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences