WordPress Import Export Suite for CSV and XML Datafeed Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Import Export Suite for CSV and XML Datafeed plugin for WordPress, affecting all versions through 7.19. This issue arises from inadequate file path validation in the deleteImage() function, enabling authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server. Such actions could easily result in remote code execution if critical files, like wp-config.php, are removed.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the server, potentially allowing for remote code execution if a sensitive file is deleted.

Remediation

Users are advised to update the plugin to version 7.19.1 or 7.20.1.