WordPress Import Export Suite for CSV and XML Datafeed Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Import Export Suite for CSV and XML Datafeed plugin for WordPress, affecting all versions through 7.19. The issue arises from inadequate file type validation in the import_single_post_as_csv() function, which enables authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server. This vulnerability could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the possibility of remote code execution on the affected server.

Remediation

Users are advised to update the plugin to version 7.19.1 or 7.20.1, both of which contain the necessary security fix.