Vulnerability · Published Dec 5, 2022 · Assigned by WPScan
CVE-2022-3677Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF
Medium 6.5
In plain English
A medium-severity security flaw in Advanced Import : One Click Import for WordPress or Theme Demo Data from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 68.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced Import : One Click Import for WordPress or Theme Demo Data | 0 – before 1.3.8 |
References
- https://wpscan.com/vulnerability/5a7c6367-a3e6-4411-8865-2a9dbc9f1450 exploit, vdb-entry, technical-description