TI-2022-03156 Aliases CVE-2022-3418 GHSA-qff8-jrqx-8xjm

WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE

HIGH 67CWE-94Published 2022-11-07 · Updated 2025-05-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01455 73rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Import any XML or CSV File to WordPress (Unknown): 3.6.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Import any XML or CSV File to WordPress	3.6.9 to before 3.6.9	3.6.9	Patch available	CNA

Import any XML or CSV File to WordPress VendorUnknown Affected 3.6.9 to before 3.6.9 Fixed in 3.6.9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:soflyy:wp_all_import::::::wordpress::*	before 3.6.9	Vulnerable	Soflyy

cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:*:wordpress:*:* Versions before 3.6.9 Vulnerable ·Soflyy

Remediation

Fix · CNA Import any XML or CSV File to WordPress (Unknown) Fixed in 3.6.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-11-07
Import any XML or CSV File to WordPress 3.6.9
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2022-02509 WP All Import < 3.6.9 - Admin+ Directory traversal via file uploadPriority HIGH 65
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-3418
2026-10-03 Alias added: GHSA-qff8-jrqx-8xjm

References

Exploit 1

https://wpscan.com/vulnerability/ccbb74f5-1b8f-4ea6-96bc-ddf62af7f94d

TI-2022-02509 WP All Import < 3.6.9 - Admin+ Directory traversal via file upload CVSS 3.1HIGH 7.2
TI-2015-07707 The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. CVSS 3.0CRITICAL 9.8
TI-2022-16725 WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability CVSS 3.1CRITICAL 9.1
TI-2015-07708 The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. CVSS 3.0HIGH 7.5
TI-2024-08966 WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File CVSS 3.1HIGH 7.2
TI-2022-02093 WP All Import < 3.6.8 - Admin+ Arbitrary File Upload CVSS 3.1HIGH 7.2

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences