Arbitrary File Upload Vulnerability in AIT CSV Import/Export Plugin for WordPress
CVE-2020-36849
9.8CRITICAL
What is CVE-2020-36849?
The AIT CSV Import/Export plugin for WordPress has a vulnerability due to insufficient file type validation in the upload handler. This allows unauthorized users to upload arbitrary files to the server, potentially leading to remote code execution. Versions 3.0.3 and earlier are affected, making it critical for users to update to secure their sites against exploitation by attackers.
Affected Version(s)
AIT CSV import/export * <= 3.0.3
References
EPSS Score
65% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved