TI-2022-02997 Aliases CVE-2022-3244 GHSA-vj5x-x7x2-xq6v

Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation

MEDIUM 53CWE-862Published 2022-10-17 · Updated 2025-05-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00491 42nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Import all XML, CSV & TXT into WordPress (Unknown): 6.5.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Import all XML, CSV & TXT into WordPress	6.5.8 to before 6.5.8	6.5.8	Patch available	CNA

Import all XML, CSV & TXT into WordPress VendorUnknown Affected 6.5.8 to before 6.5.8 Fixed in 6.5.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:::::wordpress:::*	before 6.5.8	Vulnerable	smackcoders

cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:wordpress:*:*:* Versions before 6.5.8 Vulnerable ·smackcoders

Remediation

Fix · CNA Import all XML, CSV & TXT into WordPress (Unknown) Fixed in 6.5.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-10-17
Import all XML, CSV & TXT into WordPress 6.5.8
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2022-02996 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLiPriority HIGH 73
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-3244
2026-10-03 Alias added: GHSA-vj5x-x7x2-xq6v

References

Exploit 1

https://wpscan.com/vulnerability/de4bc449-3dd4-4776-943f-ac59ae813132

TI-2022-02996 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi CVSS 3.1HIGH 7.2
TI-2018-14929 The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. CVSS 3.0HIGH 8.8
TI-2015-08053 WP Ultimate CSV Importer Plugin cross-site request forgery CVSS 3.1HIGH 8.8
TI-2022-01833 WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF CVSS 3.1HIGH 7.2
TI-2015-07683 The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. CVSS 3.0MEDIUM 6.1
TI-2022-00285 WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences