WordPress Import Any XML, CSV or Excel File Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the WordPress Import Any XML, CSV or Excel File Plugin, affecting all versions through 3.9.3. The issue arises from inadequate file type validation in the import feature, which enables authenticated attackers with Administrator-level access to upload potentially harmful files, such as .phar files, to the server. This could lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution if malicious files are uploaded and executed on the server.

Remediation

Users are advised to update the plugin to version 3.9.4 or a newer patched version.