Vulnerability · Published Apr 11, 2022 · Assigned by WPScan
CVE-2022-1008One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload
High 7.2
In plain English
A high-severity unrestricted file upload in One Click Demo Import from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | One Click Demo Import | 3.1.0 – before 3.1.0 |
Weakness: CWE-434
References
- https://wpscan.com/vulnerability/0c2e2b4d-49eb-4fd9-b9f0-3feae80c1082 x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2695999 x_refsource_CONFIRM