Arbitrary File Upload Vulnerability in AIT CSV Import/Export Plugin for WordPress
CVE-2020-36849

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Ait Csv Import/export
Vendor
CVE Published:
12 July 2025

What is CVE-2020-36849?

The AIT CSV Import/Export plugin for WordPress has a vulnerability due to insufficient file type validation in the upload handler. This allows unauthorized users to upload arbitrary files to the server, potentially leading to remote code execution. Versions 3.0.3 and earlier are affected, making it critical for users to update to secure their sites against exploitation by attackers.

Affected Version(s)

AIT CSV import/export * <= 3.0.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.ait-themes.club/wordpress-plugins/csv-import-...
https://www.acunetix.com/vulnerabilities/web/wordpress-pl...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-36849 : Arbitrary File Upload Vulnerability in AIT CSV Import/Export Plugin for WordPress