WP Import Ultimate CSV XML Importer for WordPress Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the WP Import – Ultimate CSV XML Importer for WordPress plugin, affecting all versions through 7.27. The issue arises from inadequate file path validation in the 'upload_function()' method, which enables authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. This vulnerability could easily lead to remote code execution if a critical file, such as 'wp-config.php', is deleted.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server. Deleting certain files, like 'wp-config.php', could lead to remote code execution.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'upload_function' via AJAX. The request must include FTP credentials and a file path that, when processed, bypasses the insufficient validation and leads to the deletion of a targeted file on the server.

Remediation

Users are advised to update the WP Import – Ultimate CSV XML Importer for WordPress plugin to version 7.28 or later.