CVE-2022-2711

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-271105.4OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint.CVE-2022-271115.4Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.CVE-2022-271145.5There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they a CVE-2022-271159.8In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.CVE-2022-27127.5In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path st CVE-2022-271239.8Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter.CVE-2022-271249.8Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-271256.1zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.CVE-2022-271269.8zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.CVE-2022-271276.5zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.CVE-2022-271289.8An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.CVE-2022-271299.8An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.